SonicWall VPN flaw exploited, MFA bypassed

A vulnerability in SonicWall's SSL-VPN service can let someone who already holds credentials for a different authentication method slip past SAML controls — including SAML-enforced multi-factor authentication. SonicWall says it has investigated a report that the flaw was used in an attack, and the U.S. government's cyber agency has now confirmed exploitation in the wild.

The company shipped fixes for that bug and six others in SonicOS this week, and the affected code sits in firewall software that many organizations rely on at the network edge.

What the SAML bypass does

The flaw is tracked as CVE-2026-19868. According to SonicWall's security advisory, it allows attackers who hold valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication.

SonicOS SSL-VPN services configured to use SAML authentication are the only ones affected. The vulnerability carries a CVSS severity score of 7.1.

Ryan Harris of The Electronic Office discovered and reported the vulnerability, according to the advisory.

SonicWall's own warning

The advisory was published Friday. In it, SonicWall said its product security team had investigated a report indicating exploitation and told customers to move to the newest release.

"SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company warned.

— SonicWall, in its security advisory

The company has not shared details about the reported exploitation.

CISA adds it to KEV

The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, which confirms the flaw has been exploited in the wild.

CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.

Six more holes in the same update

The advisory covers six additional vulnerabilities in SonicOS beyond the SAML bypass. Two of them are management interface flaws rated 8.8 severity that allow unauthenticated attackers to perform unauthorized operations under specific conditions.

The rest of the set includes pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, plus a weak password hashing vulnerability affecting virtual appliances.

SonicWall says no workarounds are available, so upgrading is the fix the company points to.

Which versions are exposed

The bugs affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015.

Admins running either generation should check their build number against those figures before assuming they are covered.

• CVE-2026-19868 carries a CVSS score of 7.1
• Two management interface flaws are rated 8.8
• Affected: SonicOS Gen7 7.3.3-7015 and earlier; Gen8 8.2.2-8015 and earlier
• Fixed in: 7.3.4-7013 and 8.2.3-8015
• CISA federal remediation deadline: November 20, 2026

A run of SonicWall attacks

The SAML bypass warning follows a series of attacks aimed at SonicWall's SMA1000 secure remote access appliances.

In October, researchers detected exploitation attempts against CVE-2026-102255, a maximum-severity vulnerability that could let unauthenticated attackers reach internal functionality and perform unauthorized operations.

Those attempts came after September attacks that chained two SMA1000 zero-days to achieve remote code execution, and July attacks that exploited two other zero-days to deploy malware on vulnerable appliances.

What to do with the patch

SonicWall's guidance is direct: upgrade to the latest release. The advisory lists no workaround, and the fixed builds are 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8.

For organizations that expose SSL-VPN with SAML, the relevant question is whether their current build predates those numbers. SonicWall's advisory is the reference point for the full list of fixes in the release.

Why this matters for defenders

The SAML bypass matters because it targets the layer many organizations treat as their strongest control on remote access. If an attacker who already has credentials for another method can get around SAML-enforced MFA, then the second factor is only as good as the code path that enforces it — and the enforcement path here is the part that was flawed.

For administrators, the practical takeaway is to verify build numbers rather than assume a recent update covered this. The CISA KEV listing gives a firm marker that exploitation has occurred, and the agency's November 20, 2026 deadline for federal agencies shows how it is prioritizing remediation. Organizations outside the federal civilian branch can read that deadline as a signal of urgency without treating it as their own compliance date.

The broader run of SonicWall exploitation this year — SMA1000 flaws in July, September, and October, and now a SonicOS SSL-VPN bypass — suggests edge appliances remain a favored target. That does not mean every SonicWall deployment is compromised, but it does mean patch status on internet-facing gear deserves a direct check.