SonicWall patches exploited SonicOS flaw CVE-2026-19868 that bypasses VPN SAML and MFA

What happened

SonicWall has shipped patches for a serious authentication flaw in SonicOS that is already being exploited in the wild. The vulnerability, tracked as CVE-2026-19868 and addressed in advisory SNWLID-2026-0014, affects the SSL VPN on Gen7 and Gen8 appliances where SAML-based sign-in is enabled. CISA added the bug to its Known Exploited Vulnerabilities catalog on November 6, 2026, a list the agency reserves for flaws with confirmed active exploitation. According to SecurityWeek, SonicWall is still investigating reports of exploitation, and no details about actual attacks — such as the requests used, source addresses or victim counts — have been published.

How the bypass works

This is not a fully unauthenticated, pre-authentication attack. An attacker first needs working credentials for an authentication method other than SAML, for instance a local or LDAP account, on a VPN portal configured for SAML login. Because SonicOS fails to correctly enforce which authentication path must be used, those credentials can be used to slip past SAML verification. Critically, any multi-factor authentication enforced through SAML is skipped along with it, so MFA on its own does not stop the intruder.

What an attacker gains afterward depends on the privileges of the compromised account and the network configuration behind the VPN. Public reporting does not indicate whether successful sessions have been used for lateral movement, data theft or malware deployment, and it is unclear whether the flaw was exploited as a zero-day before the patch shipped.

Affected versions and the fix

According to SonicWall's advisory, as relayed by SecurityWeek and BleepingComputer, the vulnerable releases are:

• Gen7 firmware 7.3.3-7015 and earlier
• Gen8 firmware 8.2.2-8015 and earlier

Fixed releases are Gen7 7.3.4-7013 or later and Gen8 8.2.3-8015 or later. SonicWall has not offered a workaround, and administrators should not treat disabling SAML as a durable fix — updating is the priority. Resetting credentials reduces the risk of reuse but does nothing about the underlying enforcement flaw.

What administrators should check

Because no indicators of compromise have been released, detection depends on correlating logs. The most useful signal is a VPN session on the SonicOS side with no matching successful SAML authentication or MFA event in the identity provider's records. Administrators should also review login methods, usernames, source IPs and session timestamps, and watch for traffic from VPN-assigned addresses reaching internal resources, management interfaces or file shares at unusual hours. Any suspicious sessions should be terminated and the associated credentials revoked.

Why it matters

The bug undercuts a control most organizations treat as decisive. VPN concentrators fronted by SAML with MFA are widely assumed to be safe even when a password leaks elsewhere, but CVE-2026-19868 shows that a flaw in how a product enforces authentication boundaries can quietly nullify both factors. It also exposes a monitoring gap: teams that watch only their identity provider can miss sessions established through a different path on the appliance itself. With CISA confirming active exploitation, any organization running an affected SonicWall SSL VPN with SAML enabled should treat the upgrade as urgent, then hunt for VPN sessions that never touched the IdP.