SonicWall fixes actively exploited SSL-VPN flaw that bypasses SAML MFA

SonicWall has released fixes for an actively exploited flaw in its SonicOS SSL-VPN service that can let an attacker with valid credentials bypass SAML authentication controls, including multi-factor authentication (MFA) enforced through SAML. The company has urged administrators to apply the updates promptly; it lists no workaround.

Tracked as CVE-2026-19868, the issue is an authentication-enforcement flaw. It affects SSL-VPN logins only when SAML is enabled. SonicWall says a user who has valid credentials for an alternate authentication method may be able to avoid the SAML check. In environments where an identity provider such as Okta or Microsoft Entra ID applies MFA through SAML, that could allow a VPN login without completing that MFA step.

The flaw is not described as an unauthenticated bypass: an attacker must first possess working credentials. However, organizations should not treat SAML-enforced MFA as protection against this particular path when the affected service is unpatched. The report does not establish how credentials were obtained or describe the activity carried out after any successful access.

Affected appliances and fixes

The affected products are Gen7 and Gen8 physical and virtual firewall appliances running SonicOS firmware versions 7.3.3-7015 and earlier, or 8.2.2-8015 and earlier. SonicWall lists fixes in version 7.3.4-7013 and later, and version 8.2.3-8015. Administrators should identify affected appliances and upgrade to a fixed release appropriate to their platform.

The same SonicOS releases address six additional vulnerabilities. The source report says none of those six has been flagged as exploited. Gen6 firewalls are not listed as affected by CVE-2026-19868, but SonicWall says Gen6 products have reached end of support and advises customers using those or older hardware to upgrade to a Gen8 firewall.

Exploitation confirmed, but details remain limited

SonicWall’s product security incident response team said it had investigated a report indicating potential exploitation of CVE-2026-19868. The company has not provided details about the attacks. The vulnerability was discovered and reported by Ryan Harris of IT services provider Electronic Office.

The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. U.S. civilian federal agencies are required to address the flaw by November 20, 2026. The available information does not establish how many organizations have been affected or what attackers did after gaining VPN access.

Neither SonicWall nor CISA has published indicators of compromise, and the report notes that no security company had published an analysis of the attacks at the time. This limits defenders’ ability to look for campaign-specific traces. It does not remove the value of reviewing authentication records, especially where SAML is expected to be part of every SSL-VPN sign-in.

What administrators should do

• Inventory Gen7 and Gen8 physical and virtual appliances, identify systems on affected firmware, and install the applicable fixed release.
• For SSL-VPN deployments using SAML, compare successful VPN logins with the identity provider’s sign-in records. Investigate sessions without a corresponding sign-in and MFA check.
• Reset credentials for accounts associated with an anomalous login, then review what those VPN sessions accessed.
• Include end-of-support Gen6 or older appliances in upgrade planning, following SonicWall’s recommendation to move to Gen8 hardware.

SonicWall SSL-VPN appliances have been targeted in earlier incidents, according to the report. In 2025, Akira affiliates compromised SonicWall firewalls despite OTP-based MFA being enabled. Earlier in 2026, ReliaQuest observed exploitation of CVE-2024-12802, another SonicWall SSL-VPN MFA-bypass flaw, in multiple environments. Those cases underline the importance of promptly patching exposed access infrastructure, while they do not establish any connection to the current exploitation.

For CVE-2026-19868, patching and log review are the immediate defensive priorities supported by the available details. Since public indicators and an attack analysis are not available, organizations should base investigations on their own VPN and identity-provider records rather than assume a specific attacker method or impact.