A newly patched SonicOS vulnerability lets an attacker with valid credentials for one login method slip past SAML-based multi-factor authentication.
BleepingComputer reports that SonicWall has patched seven SonicOS vulnerabilities, including CVE-2026-19868, an authentication-enforcement flaw in the SonicOS SSL-VPN service that is already being exploited. The bug lets a user who already holds valid credentials for an alternate authentication method bypass SAML authentication controls, which can also mean bypassing SAML-enforced MFA. It carries a CVSS score of 7.1 and only affects SSL-VPN services configured to use SAML login. SonicWall says it investigated a report of exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal agencies until November 20, 2026 to secure affected systems.
Affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier, fixed in 7.3.4-7013 and 8.2.3-8015 respectively, with no workarounds available. The flaw was reported by Ryan Harris of The Electronic Office.
Why it matters: MFA is the control enterprises lean on hardest for remote access, and a bypass in a widely deployed VPN gateway undercuts that assumption directly. Patch SonicOS promptly, review SAML-based SSL-VPN configurations, and treat any account that authenticated through an alternate method as worth a closer look.