SonicWall SSL-VPN MFA bypass flaw exploited in attacks
Original title: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
SonicWall released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw tracked as CVE-2026-19868. The flaw allows attackers with valid credentials for an alternate authentication method to bypass SAML controls that may include MFA. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 20. The advisory also fixes six other flaws in affected SonicOS versions.
- Only affects SonicOS SSL-VPN services configured with SAML authentication
- CISA ordered agencies to secure systems by November 20
- Fixed in SonicOS 7.3.4-7013 and 8.2.3-8015
- Discovered and reported by Ryan Harris
Impact: bypass of SAML-enforced MFA
- 1.Upgrade to latest SonicOS release
- 2.Check for CVE-2026-19868
- CVEs
- CVE-2026-19868
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-19868 | SAML bypass in SonicWall SonicOS SSLVPN | 7.5 | <1% | KEVPoC | KEV |
From the original article
2 min read at bleepingcomputer.com
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]
By Lawrence Abrams · bleepingcomputer.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.