THE CRUNCH
SonicWall has patched a high-severity flaw in its SonicOS operating system that can let attackers bypass SAML authentication on its SSL VPN, potentially defeating SAML-enforced multi-factor authentication. The company warns the bug, tracked as CVE-2026-19868, may have been exploited in attacks, and CISA has added it to its Known Exploited Vulnerabilities catalog.
The flaw works by letting someone who already holds valid credentials for an alternate login method slip past SAML authentication controls, which is how the MFA check can be bypassed too. It only applies where SAML-based login is enabled, and it affects Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, plus Gen8 TZ, NSa and NSv firewalls on SonicOS 8.2.2-8015 or older.
Fixed versions are SonicOS 7.3.4-7013 and 8.2.3-8015, and SonicWall says there are no workarounds, so upgrading is the only mitigation. The bug was reported by Ryan Harris of The Electronic Office and carries a CVSS score of 7.1.
It was one of seven flaws in SonicWall's November 6 advisory, though the vendor has not marked any of the others as exploited. Those include two management interface bugs rated 8.8 that could allow unauthenticated remote attackers to take unauthorised actions, three pre-authentication buffer overflows usable for denial-of-service attacks, and a weak password hashing issue in virtual appliances.
Neither SonicWall nor CISA has described the suspected attacks, and it remains unclear whether the flaw was exploited as a zero-day before the patch appeared.