SonicWall VPN vulnerability patched after suspected SAML bypass

SecurityWeek reports that SonicWall released patches for a SonicOS flaw that can let an attacker bypass SAML authentication for the SSL VPN component, and the vendor warned the bug may have been exploited. The issue, tracked as CVE-2026-19868, can allow an account that can authenticate through an alternate method to get past SAML controls and SAML-enforced multi-factor authentication for SSL VPN access.

What happened and who reported it

According to SecurityWeek, SonicWall published an advisory covering seven SonicOS vulnerabilities, and identified CVE-2026-19868 as an authentication enforcement flaw in the SSL VPN service. The report notes the bug was disclosed by Ryan Harris of The Electronic Office, and that SonicWall’s product security team "has investigated a report indicating potential exploitation of this vulnerability," per the vendor statement cited by SecurityWeek.

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on the same day, and under Binding Operational Directive 26-04 the agency set a remediation deadline for federal agencies. SecurityWeek reports the directive requires agencies to address the issue by November 20.

Which devices and versions are affected

SecurityWeek lists the affected devices and SonicOS releases. Impacted models include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older. Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older are also affected.

SonicWall published patched releases that resolve the issue: SonicOS 7.3.4-7013 and 8.2.3-8015. The vendor told customers there are no workarounds for this vulnerability, and urged timely upgrades. In the advisory SonicWall wrote, "Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks." (quoted in SecurityWeek)

Other issues in the advisory

SecurityWeek says the advisory included six other SonicOS flaws. Two high-severity problems, each with CVSS scores of 8.8, affect the SonicOS management interface and can under some conditions let a remote attacker take unauthorized actions without logging in. Three additional flaws are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client, which could be used to cause application-level denial of service. The final issue is a weak password hashing problem in virtual appliances that could let an actor with already high local privileges obtain a platform credential.

SecurityWeek also points out that threat actors commonly target SonicWall products, and that CISA’s KEV catalog already contained many SonicWall-related entries at the time of reporting.

Why this matters to small organizations and public teams

If your organization uses SonicWall SSL VPNs and SAML-based logins, the flaw could let an attacker bypass your SAML controls and any SAML-enforced MFA, according to the advisory summarized by SecurityWeek. Because the vendor did not provide a workaround and CISA added the CVE to its KEV list, the issue is being treated as a high priority for remediation.

Even if you are not a SonicWall customer, this is a reminder that VPNs and remote access services are an attractive target when they use federated single sign-on or alternate authentication methods. When a bypass is possible, MFA enforced only by SAML may not be effective.

What to do now

• Apply the SonicOS updates SonicWall published (SonicOS 7.3.4-7013 or 8.2.3-8015) to affected devices as soon as you can, SecurityWeek reports. The vendor says there are no workarounds.
• Confirm whether your SSL VPN is configured to use SAML-based login, since the SSL VPN is exposed only when SAML-based login is enabled, per the SecurityWeek summary of the advisory.
• If you cannot patch immediately, reduce exposure by limiting network access to the SSL VPN interface (for example by IP allowlisting) and by reviewing who has VPN and administrative access.
• Check logs for unusual SSL VPN sign-on activity and for authentication attempts that used alternate methods, and prepare to rotate any credentials or platform secrets if you suspect compromise.
• Track CISA guidance and the KEV catalog entry for this CVE, especially if you manage or support federal systems, because SecurityWeek reports a remediation deadline under Binding Operational Directive 26-04.

Want to know how exposed your own site is? Start with a free external scan.

Bottom line

SecurityWeek reports SonicWall fixed a high-severity SonicOS SSL VPN bug that can bypass SAML and SAML-enforced MFA, and the CVE was added to CISA’s Known Exploited Vulnerabilities list. If you run affected SonicWall devices or manage remote access for someone who does, apply the updates and limit VPN exposure until you can confirm systems are on the patched releases.