SonicWall Warns of Actively Exploited SSLVPN Flaw That Can Bypass MFA

SonicWall has patched CVE-2026-19868, a SonicOS SSLVPN flaw that lets an attacker holding valid credentials for another login method get past SAML authentication, skipping any multifactor authentication (MFA) that SAML enforces. It only affects SSLVPN with SAML sign-in enabled. Rated CVSS 7.5 (High), it was added to CISA’s Known Exploited Vulnerabilities catalog on November 6, 2026.

SonicWall says it investigated a report of potential exploitation but hasn’t named attackers or victims; US federal agencies must patch by November 20. Fixes are in SonicOS 7.3.4-7013 and later for Gen7 and 8.2.3-8015 and later for Gen8, covering hardware and NSv appliances on 7.3.3-7015, 8.2.2-8015, and earlier. No workaround exists.

Source: Cyber Security News