SonicWall VPN MFA Bypass: What Indian Firms Must Do

In short: On 6 November 2026 SonicWall released fixes for seven SonicOS flaws. One of them, CVE-2026-19868, lets a person with valid non-SAML login details bypass SAML sign-in, including SAML-enforced MFA, on SSL-VPN. CISA has listed it as exploited. Firms using SonicWall Gen7 or Gen8 firewalls with SAML VPN login should update now.

What Happened

SonicWall published security advisory SNWLID-2026-0014 on 6 November 2026, covering seven vulnerabilities in SonicOS, the operating system of its firewalls. The most urgent is CVE-2026-19868, an SSL-VPN authentication bypass rated CVSS 7.1.

According to the advisory and reporting by ITPro (9 November 2026) and BleepingComputer, a user who holds valid credentials for another login method can get past SAML authentication on the SSL-VPN, including MFA that is enforced through SAML. The flaw matters only where SAML-based login is enabled.

The US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026, with a 20 November deadline for US federal agencies. SonicWall has said it is looking into a report of exploitation but has not shared details of affected organisations or indicators of compromise. SonicWall also says there is no workaround: updating is the only fix.

Affected and fixed versions

Firewall generation	Affected SonicOS versions	Fixed version
Gen7	7.3.3-7015 and earlier	7.3.4-7013
Gen8	8.2.2-8015 and earlier	8.2.3-8015

The same advisory fixes six more flaws that are not reported as exploited: two management interface issues rated CVSS 8.8 (CVE-2026-107155 and CVE-2026-107154), a pre-authentication heap overflow that can crash the device (CVE-2026-82308, CVSS 7.5), two pre-authentication overflows in the TACACS+ client (CVE-2026-77708 and CVE-2026-77709, CVSS 5.9) and weak password hashing on virtual appliances (CVE-2026-19703, CVSS 5.2). Always confirm the exact details for your model in the SonicWall advisory.

Who Is Affected

SonicWall firewalls are common in Indian offices, factories, hospitals, schools and branch networks, often with SSL-VPN switched on for staff working from home or from other sites. You should act if:

• You run a SonicWall Gen7 or Gen8 firewall on an affected SonicOS version.
• SSL-VPN is enabled, and SAML (for example through Microsoft Entra ID, Okta or another identity provider) is used for VPN login or MFA.
• Other login methods, such as local users or LDAP accounts, are also allowed on the same VPN.

Even if you do not use SAML, the other six flaws are a reason to update, especially the management interface issues if the admin page is reachable from the internet.

What It Means for Indian Businesses and Departments

Many organisations added MFA to their VPN as their main protection after past attacks. This flaw is a reminder that MFA can be bypassed when the underlying device has a bug, and that stolen or reused passwords remain valuable to attackers. It is not the first time: SonicWall Gen6 SSL-VPN devices were hit by an MFA bypass (CVE-2024-12802) earlier in 2026, and researchers reported that some patched devices stayed exposed until the LDAP configuration was also changed. Patching and checking the configuration both matter.

A VPN compromise is also a reporting matter. Under CERT-In directions issued in April 2022, organisations in India must report listed cyber incidents, including unauthorised access to systems, to CERT-In within six hours of noticing them. Our CERT-In 6-hour incident reporting checklist explains what to prepare. Please check reporting duties with your legal or compliance adviser.

What to Do Now

1. Find every SonicWall device: list all firewalls in head office, branches and data centres with model, generation and SonicOS version.
2. Update SonicOS: move Gen7 devices to 7.3.4-7013 or later and Gen8 devices to 8.2.3-8015 or later, after taking a configuration backup and planning a short maintenance window.
3. Review VPN login methods: if SAML is used for VPN, remove or restrict local and LDAP login on the same VPN unless there is a clear need, so there is only one path in.
4. Reset exposed credentials: reset passwords for VPN accounts that use non-SAML methods, disable old and unused accounts, and remove shared accounts.
5. Lock down the management interface: make sure firewall admin access is not open to the internet and is allowed only from trusted internal addresses.
6. Check logs for unusual VPN logins: look for logins from new countries, odd hours or accounts that do not normally use VPN over the past few weeks, and investigate anything suspicious.
7. Record and report: document what you patched and found, and if you see signs of compromise, follow your incident response plan and reporting rules.

If you do not have a regular process for firewall and VPN updates, our guide to the patch management process shows how to set one up, and our post on multi-factor authentication implementation covers how to design MFA that is harder to bypass.

Frequently Asked Questions

Is there a workaround for CVE-2026-19868?

SonicWall says no workaround is available. Updating to the fixed SonicOS version is the only remediation. Restricting other login methods on the VPN reduces risk while you plan the update.

Are Gen6 SonicWall firewalls affected by this advisory?

The advisory lists Gen7 and Gen8 SonicOS versions. Gen6 devices had a separate MFA bypass flaw earlier (CVE-2024-12802). Check the SonicWall advisory for your exact model, and plan to replace end-of-support devices.

We do not use SAML. Do we still need to update?

Yes. The SAML bypass needs SAML login to be enabled, but the same update fixes six other flaws, including management interface issues rated CVSS 8.8.

How Affix Center Can Help

Affix Center helps organisations across Mumbai and India keep firewalls and VPNs patched, configured and monitored. We can check your SonicWall estate, plan and carry out updates, review VPN and MFA settings and look through logs for signs of misuse. Our cyber security services in Mumbai cover firewall hardening and monitoring, and our VAPT services can test your VPN and perimeter after the fix.

Need help checking your firewalls this week? Contact our team.