SonicWall advisory SNWLID-2026-0014 and CISA KEV addition November 6, 2026; federal remediation due November 20, 2026
Valid Credentials, No Second Factor: the SonicWall SSL-VPN Flaw That Skips SAML and Its MFA Is in the KEV Catalog
CISA added CVE-2026-19868 to the Known Exploited Vulnerabilities catalog on November 6, the same day SonicWall published advisory SNWLID-2026-0014 covering seven SonicOS flaws. The flaw is an authentication enforcement weakness, classed as CWE-308, use of single-factor authentication, in the SSL-VPN service: a user who holds valid credentials for an alternate authentication method may bypass SAML authentication controls, and successful exploitation may also bypass the multifactor authentication that SAML enforces. Two limits define the exposure. The service is exposed only where SAML handles SSL-VPN logins, and the bypass is not unauthenticated access, since the attacker needs working credentials for another sign-in method on the same firewall. SonicWall scores the flaw 7.1; CISA enrichment of the record scores it 7.5, and both describe the same facts. The flaw, reported by Ryan Harris of The Electronic Office, affects Gen 7 firewalls (TZ, NSa, NSsp, and NSv) on SonicOS 7.3.3-7015 and older and Gen 8 firewalls (TZ, NSa, and NSv) on 8.2.2-8015 and older. The fixes are 7.3.4-7013 and 8.2.3-8015, and SonicWall lists no workaround. SonicWall said its product security team investigated a report indicating potential exploitation, and CISA set the federal remediation date at November 20 under BOD 26-04, with ransomware use marked unknown. Neither the vendor nor CISA has published an attacker, a victim, a start date, or proof-of-concept code, and SecurityWeek notes it is unclear whether the flaw was exploited before a patch existed. The same advisory carries six further flaws that SonicWall does not mark as exploited, including two management interface issues scored 8.8 and three pre-authentication buffer overflows usable for denial of service.
Executives
The business risk here is quiet: a control the organization believes is enforced, SAML with multifactor authentication on remote access, can be stepped around by anyone holding a second set of valid credentials for the same firewall. Stolen or shared alternate credentials, a former contractor account, or a local login that was never retired all become full VPN access without the second factor. Ask for two answers this week: every SonicWall firewall on fixed firmware, and every alternate sign-in method still enabled on each one, with an owner for each account that remains.
CIO / CISO
Patch Gen 7 and Gen 8 firewalls to 7.3.4-7013 or 8.2.3-8015 ahead of the November 20 federal date, because there is no workaround to fall back on. In parallel, treat the account inventory as the second half of the fix: enumerate local and alternate authentication methods on every SSL-VPN, disable any method that is not required, and review VPN sign-ins for accounts that authenticated without a SAML transaction. Remember the scope line from the advisory when you report status: only SAML-configured SSL-VPN is exposed to this flaw, so state that boundary explicitly rather than declaring the whole estate affected or clear.
Engineers
Verify the running SonicOS build on the appliance itself and record it with the ticket; the fixed builds are 7.3.4-7013 for Gen 7 and 8.2.3-8015 for Gen 8. Hunt for the shape of the bypass in authentication logs: successful SSL-VPN sessions for users whose identity provider shows no matching SAML assertion, especially outside normal hours or from new source addresses. While you are on the box, note the other six flaws in SNWLID-2026-0014, including the two 8.8 management interface issues, and confirm the management interface is not reachable from untrusted networks.
Everyone (non-IT)
If you sign in to work through a SonicWall VPN, nothing changes about how you log in, and you do not need a new password for this flaw alone. The lesson that does reach everyone is the general one: a second sign-in method with a weaker password quietly cancels the protection of the strong one, at work and at home. If a service lets you sign in two ways, protect both, or turn the one you do not use off.