SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
SonicWall patches CVE-2026-19868 that bypasses SAML and MFA in SSL VPN after exploitation; CISA added it to KEV with federal deadline November 20.
SonicWall has patched a vulnerability in SonicOS that allows bypass of SAML-based authentication and MFA enforcement in SSL VPN when SAML login is enabled. The flaw, CVE-2026-19868, has CVSS score 7.1 and is tracked as exploited by CISA in its KEV catalog. Affected devices include Gen7 TZ, NSa, NSsp, NSv and Gen8 TZ, NSa, NSv firewalls running SonicOS 7.3.3-7015 or older and 8.2.2-8015 or older. Versions 7.3.4-7013 and 8.2.3-8015 fix the issue. No workarounds are available.
Unconfirmed: It is unclear whether the flaw was a zero-day or how exactly the suspected attacks occurred.
- CVE-2026-19868 CVSS 7.1
- Affects SonicOS SSL VPN component
- Impacted on Gen7 and Gen8 firewalls
- Fixed in 7.3.4-7013 and 8.2.3-8015
- CISA KEV addition same day as advisory
Impact: bypass SAML authentication and MFA
- 1.Upgrade to SonicOS 7.3.4-7013 or 8.2.3-8015
- CVEs
- CVE-2026-19868
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at securityweek.com
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.
By Eduard Kovacs · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.