5 Things We Learned From SonicWall’s MFA Bypass

On Friday, November 6, SonicWall published an advisory fixing seven SonicOS vulnerabilities. One of them, CVE-2026-19868 (CVSS 7.1), lets attackers skip SAML sign-in on the SSL VPN, MFA included, and CISA says it is already exploited. BleepingComputer has the details. No panic needed, just a firmware upgrade and a few uncomfortable questions. Here are the five things it taught us.

1. A 7.1 can still be a fire drill

A CVSS score tells you how bad a bug could be. It does not tell you what attackers are doing. SonicWall says it investigated a report of exploitation and has shared no details, and CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a federal deadline of November 20. There is no workaround. A middling score is no reason to wait when the exploitation has already been confirmed. The score is a forecast. The KEV list is the weather report.

2. MFA is only as strong as the weakest way in

Picture a VPN with two doors. The main door asks for a SAML sign-in, and that comes with an MFA prompt. The side door is another configured login method. SecurityWeek explains that someone holding valid credentials for the side door can bypass the main door’s SAML controls, including SAML-enforced MFA. CISA’s own name for the problem is SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability, which is about as blunt as a government agency gets. The catch is that the bypass needs that second door to exist, so every extra login method enabled just in case is now a liability. If your VPN offers two ways in, audit both.

3. “Valid credentials” is not a high bar

The attacker needs a working login for some other method first, and that sounds like a comfort. It is not. Passwords leak through reuse, old breaches, and the occasional compromised laptop. Stolen logins are sold in criminal channels and they move quickly, as our analysis of the Telegram channels attackers use most shows. This flaw turns one password into a pass around the second factor, and the second factor is what most organizations point to when asked what happens if a password leaks. Credential Intelligence flags stolen credentials across data breaches, paste sites, and dark web forums before attackers use them.

4. The warning and the patch arrived together

Disclosure, patch, and the CISA listing all landed on the same day, so defenders got no head start. The fix is an upgrade and nothing else: SonicOS 7.3.4-7013 for Gen7, or 8.2.3-8015 for Gen8. The flaw affects Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier, and those same two releases close all seven vulnerabilities, so one upgrade covers the lot. The advisory covers seven flaws and only this one is on the KEV list, so it sets the pace for the whole job. SonicWall has not said how many customers were hit or who is behind the attacks, so assume you are on someone’s list. Federal agencies have a deadline. Everyone else has the same flaw and no deadline, which is not the comfort it sounds like.

5. Check your own configuration before you celebrate or panic

This bug only matters if the SSL VPN uses SAML for logins. If yours does not, it does not apply to you, and if it does, it is time to find out who is on the other side of the door. Plenty of firewalls were configured by someone who has since left the company. Review recent VPN logins for sessions that skipped SAML or MFA, reset credentials tied to alternate login methods, and switch off any method you do not need. Attack Surface Management finds the VPN gateways that are reachable from the internet. If you only have ten minutes, confirm the firmware version, confirm whether SAML is on, and book the upgrade.

Edge devices have had a rough autumn. Our October 26 roundup covered attackers rooting Palo Alto firewalls through exposed management interfaces, and our latest weekly roundup covers a Zyxel switch exploit that beat the patch. Auditors tick the MFA box once. Attackers test it constantly.

Your MFA is a promise, and every login path has to keep it. Better a boring Wednesday patch than an exciting Friday incident. CybelAngel maps what is reachable from the outside, so a gateway like this one shows up on your list before it shows up on a federal one.