SonicWall SSL-VPN bug lets attackers bypass SAML-enforced MFA
CVE-2026-19868 is confirmed under active attack and now on CISA's exploited list. Federal agencies must patch by 20 November.
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalogue on 6 November. It affects SonicWall’s SonicOS SSL-VPN service: an attacker who already holds valid credentials for one authentication method can use them to bypass SAML authentication checks on the VPN, which also neutralises any SAML-enforced multi-factor authentication sitting in front of it.
SonicWall’s own PSIRT says it investigated reports of active exploitation against client environments before publishing its advisory. Affected versions are SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015. Fixes are out: 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. CISA has set a 20 November remediation deadline for federal civilian agencies.
Why it matters: SAML-backed MFA is exactly the control a lot of teams rely on to treat a leaked or phished password as low-risk. This bug means a stolen single-factor credential for an alternate login method is enough to get past that protection on an exposed SSL-VPN. If you or your hosting provider run SonicWall gear at the edge, this is a patch to check for today, not a maybe-later.
The caveat: there’s no public workaround beyond upgrading. If you can’t patch immediately, the usual fallback is restricting SSL-VPN access by source IP until you can.