Science & Tech · Cybersecurity · 1 hr ago
SonicWall fixes SSL-VPN flaw that can bypass SAML multi-factor authentication
SonicWall has issued updates for a flaw in its SonicOS firewall software that may let attackers bypass some login checks.
The vulnerability affects SSL-VPN services configured to use SAML authentication, a system organisations can use to manage logins.
An attacker needs valid credentials for an alternative login method but may then bypass SAML controls, including multi-factor authentication enforced through SAML.
The flaw is not an unauthenticated way into a network, but it could weaken security for organisations that rely on these protections for remote access.
CISA added the flaw to its Known Exploited Vulnerabilities catalog, and SonicWall said it investigated a report of possible exploitation.
SonicWall urges customers to install the latest updates, which also address six other vulnerabilities; the company says there are no workarounds.
Federal civilian agencies must fix the flaw by November 20, 2026, while private organisations are advised to review their systems and address it.
SonicWall released updates for a flaw that can let attackers with valid credentials for an alternative authentication method bypass SAML controls, including SAML-enforced multi-factor authentication.
The vulnerability, tracked as CVE-2026-19868, affects SonicOS SSL-VPN services configured to use SAML authentication.
SonicWall said it investigated a report of possible exploitation and urged customers to install the latest updates.
CISA added the flaw to its Known Exploited Vulnerabilities catalog and set a deadline for federal civilian agencies to address it.
The updates also fix six other SonicOS vulnerabilities.
- Who
- SonicWall issued the updates; attackers with valid credentials for an alternate authentication method may exploit the flaw.
- What
- CVE-2026-19868 can bypass SAML authentication controls, potentially including SAML-enforced MFA.
- When
- SonicWall announced the updates on November 7, 2026.
- Where
- SonicOS SSL-VPN services configured to use SAML authentication.
- Why
- The flaw can allow attackers to circumvent intended authentication controls. SonicWall urged customers to update to reduce risk.
This story does not have two clearly opposing sides.
SonicWall announced security updates for seven SonicOS vulnerabilities, including CVE-2026-19868.
CISA’s deadline for federal civilian executive branch agencies to secure affected systems.
- Vulnerability
- CVE-2026-19868
- CVSS score
- 7.1 in BleepingComputer; 7.5 in Security Affairs
- Affected service
- SonicOS SSL-VPN configured to use SAML
- Fixed versions
- SonicOS 7.3.4-7013 and 8.2.3-8015
- CISA deadline
- November 20, 2026
3 sources
What people are saying
SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.