Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication.

With no workarounds listed, the company has urged admins to patch quickly.

About CVE-2026-19868

CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins.

According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls and, with them, any MFA enforced through SAML.

In practice, that means a VPN login that should have gone through the organization’s identity provider (e.g., Okta or Microsoft Entra ID) and its MFA check can succeed with a password alone.

This is not an unauthenticated bypass: attackers need working credentials first. But stolen VPN credentials are hardly in short supply, and SAML-enforced MFA is exactly the control many organizations rely on to make them useless for attackers.

The same SonicOS releases fix six other vulnerabilities, none of which have been flagged as exploited.

The vulnerabilities affect Gen7 and Gen8 physical and virtual firewall appliances running firmware versions 7.3.3-7015 and older and 8.2.2-8015 and older. Fixes have been shipped in versions 7.3.4-7013 and higher, and v8.2.3-8015.

Gen6 firewalls are not listed as affected, but they have reached the end-of-support stage, and SonicWall advises customers running those or older hardware to upgrade to a Gen8 firewall.

No attack details and no IoCs

“SonicWall PSIRT has investigated a report indicating potential exploitation of [CVE-2026-19868],” the company said, but has not shared any details about the attacks.

SonicWall SSL-VPN devices have been a favorite target of ransomware-linked attackers for a while now: in 2025, Akira affiliates compromised SonicWall firewalls even though OTP-based MFA was enabled, and earlier this year ReliaQuest observed attackers exploiting CVE-2024-12802, another SonicWall SSL-VPN MFA bypass, in multiple environments.

CVE-2026-19868 was discovered and reported by Ryan Harris of IT services provider Electronic Office.

CISA added the flaw to its Known Exploited Vulnerabilities catalog based on evidence of active exploitation. US civilian federal agencies are required to address it by November 20, 2026.

It’s currently unknown how many organizations have been hit and what the attackers did once they got in. Neither SonicWall nor CISA has published indicators of compromise (IoCs), and no security company has yet published an analysis of the attacks.

With that in mind, organizations that use SAML for SSL-VPN logins should:

• Review recent SSL-VPN logins and look for any that succeeded without a matching sign-in (and MFA check) in the identity provider’s logs.
• Reset the credentials of any account that logged in that way, and check what was accessed via those sessions.

Subscribe to our breaking news e-mail alert to never miss out on the latest breaches, vulnerabilities and cybersecurity threats. Subscribe here!