SonicWall SSL-VPN vulnerability bypasses SAML and MFA
Original title: SonicWall Warns of Actively Exploited SSL-VPN Vulnerability That Bypasses SAML and MFA Protection
SonicWall SSL-VPN auth bypass CVE-2026-19868 affects Gen7 and Gen8 SonicOS, fixed in 7.3.4-7013 and 8.2.3-8015.
SonicWall has urged customers to address an SSL-VPN authentication vulnerability that can bypass SAML controls, including associated multifactor authentication measures. This issue is tracked as CVE-2026-19868 and affects SonicOS deployments that utilize SAML for SSL-VPN logins. Affected versions are SonicOS 7.3.3-7015 or earlier for Gen7 hardware and 8.2.2-8015 or earlier for Gen8 systems. Fixed releases are 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8. The advisory provides no workaround.
Unconfirmed: SonicWall has investigated reports suggesting potential exploitation but has not confirmed a widespread attack campaign
- CVSS score of 7.1 for SSL-VPN authentication enforcement vulnerability
- Requires valid credentials for alternate authentication method
- Affects Gen7: 7.3.3-7015 or earlier; Gen8: 8.2.2-8015 or earlier
Impact: bypass SAML authentication controls and MFA
- 1.Update to fixed firmware versions
- 2.Verify appliance generation and firmware version
- CVEs
- CVE-2026-19868
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at gbhackers.com
SonicWall has urged customers to address an SSL-VPN authentication vulnerability that can bypass SAML controls, including associated multifactor authentication measures. This issue is tracked as CVE-2026-19868 and affects SonicOS deployments that utilize SAML for SSL-VPN logins. The company has investigated reports suggesting potential exploitation but has not confirmed a widespread attack campaign in its advisory.
By Divya · gbhackers.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.