Exploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Original title: Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
SonicWall fixed CVE-2026-19868, an exploited authentication-enforcement flaw in SonicOS SSL-VPN that applies only when SAML is enabled for VPN logins. A user with valid credentials for an alternate method may bypass SAML controls and any MFA enforced through them. Gen7 and Gen8 appliances on 7.3.3-7015 and older or 8.2.2-8015 and older are affected; fixes are 7.3.4-7013 and higher and v8.2.3-8015. CISA added the flaw to the KEV catalog. No indicators or attack details have been published.
Unconfirmed: How many organizations were hit, and what attackers did after access, is unknown.
- The same releases fix six other vulnerabilities that are not flagged as exploited.
- Gen6 firewalls are not listed as affected but are end of support.
- Ryan Harris of Electronic Office discovered and reported the flaw.
- SonicWall PSIRT investigated a report of potential exploitation without sharing attack details.
- No workarounds are listed.
Impact: VPN login with a password, bypassing SAML-enforced MFA
| Product | Affected | Fixed in |
|---|---|---|
| SonicWall SonicOS | 7.3.3-7015 and older; 8.2.2-8015 and older | 7.3.4-7013 and higher; v8.2.3-8015 |
- 1.Patch Gen7 and Gen8 firewalls to 7.3.4-7013 and higher or v8.2.3-8015.
- 2.Review SSL-VPN logins that lack a matching identity-provider sign-in and MFA check.
- 3.Reset credentials for accounts that logged in that way and review what those sessions accessed.
- CVEs
- CVE-2026-19868
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at helpnetsecurity.com
SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly.
By Zeljka Zorz · helpnetsecurity.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.