SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

Overview

A high-severity vulnerability has been identified in SonicWall SonicOS, tracked as CVE-2026-19868, with a CVSS score of 7.1 (High).

 The vulnerability is related to an authentication bypass in the SSL-VPN service configured to use Security Assertion Markup Language (SAML) authentication.

 The flaw allows attackers with valid credentials for an alternative authentication method to bypass SAML authentication controls, potentially including SAML-enforced Multi-Factor Authentication (MFA).

 SonicWall has confirmed investigating a report of potential exploitation of this vulnerability in attacks. Additionally, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming exploitation in the wild.

 CVE Details

Vulnerability Name: SonicWall SonicOS SSL-VPN SAML Authentication Bypass Vulnerability

CVE ID: CVE-2026-19868

Vulnerability Type: Authentication Bypass

Severity: High

CVSS Score: 7.1

Affected Component: SonicWall SonicOS SSL-VPN with SAML Authentication

Attack Vector: Network

Attack Complexity: Low

Privileges Required: Required (valid credentials for an alternative authentication method)

Exploitation Status: Exploitation reported in the wild

Who It Impacts

This vulnerability affects organizations using vulnerable SonicWall firewall appliances running SonicOS with SSL-VPN services configured for SAML authentication.

Potentially affected environments include:

• SonicWall Gen7: SonicOS versions 7.3.3-7015 and earlier.

• SonicWall Gen8: SonicOS versions 8.2.2-8015 and earlier.

How It Impacts

If successfully exploited, the vulnerability could allow an attacker with valid credentials for an alternative authentication method to bypass SAML authentication controls, including MFA protections.

Potential security impacts include:

•  Potential bypass of MFA enforcement configured through SAML.

• Access to protected remote-access services and internal network resources.

• Potential exposure of internal systems and organizational resources following unauthorized access.

Affected Products and Fixed Releases

 The following SonicWall SonicOS versions are affected by CVE-2026-19868:

SonicWall Gen7

Affected Version: SonicOS 7.3.3-7015 and earlier.

Fixed Version: SonicOS 7.3.4-7013.

 SonicWall Gen8

Affected Version: SonicOS 8.2.2-8015 and earlier.

Fixed Version: SonicOS 8.2.3-8015.

Recommendations

• Identify SonicWall firewall appliances running affected SonicOS versions across the organization.

• Immediately upgrade affected Gen7 appliances to SonicOS 7.3.4-7013 or later supported security releases.

• Upgrade affected Gen8 appliances to SonicOS 8.2.3-8015 or later supported security releases.

• Review SSL-VPN configurations and identify services configured to use SAML authentication.

• Verify that all affected appliances are running the patched firmware versions after upgrading.

References Links

• SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

• Known Exploited Vulnerabilities Catalog | CISA

• https://nvd.nist.gov/vuln/detail/CVE-2026-19868