SonicWall warns of SSLVPN flaw bypassing MFA
Original title: SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA
CVE-2026-19868 in SonicOS SSLVPN allows credentialed attackers to bypass SAML and MFA when enabled; fix available in versions 7.3.4-7013 and 8.2.3-8015.
SonicWall alerted customers to CVE-2026-19868, a flaw in SSLVPN that bypasses authentication controls when SAML is enabled for logins. The issue affects only specific configurations and requires valid alternate credentials. The company investigated reports of potential exploitation and urges immediate patching. Additional vulnerabilities in the advisory impact management interfaces and TACACS+. Affected releases include SonicOS 7.3.3-7015 and earlier on Gen7 hardware, and 8.2.2-8015 and earlier on Gen8.
Unconfirmed: No confirmed attacker activity or victim details reported
- Flaw tracked as CVE-2026-19868 with CVSS 7.1
- Affects SSLVPN only when SAML enabled
- Fixes in 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8
- No workaround provided
- Seven issues listed in latest advisory
Impact: Bypass of SAML and MFA authentication
- 1.Upgrade to fixed SonicOS releases
- 2.Review SAML and authentication methods
- 3.Monitor for unauthorized VPN access
- CVEs
- CVE-2026-19868
- Vendors
- SonicWall
- Products
- SonicOS SSLVPN
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at cybersecuritynews.com
SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks. Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7. 1.
By Guru Baran · cybersecuritynews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.