SonicWall is warning of a high-severity, exploited authentication bypass flaw impacting its SSL VPN service.
According to SonicWall, the flaw (CVE-2026-19868) can allow attackers with valid credentials for “an alternative authentication method” to bypass SAML authentication controls (including SAML-enforced multi-factor authentication (MFA).
SonicWall said its Product Security Incident Response Team (PSIRT) investigated a report indicating potential exploitation of the vulnerability. On Nov. 6, the Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerability catalog.
“SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability,” according to SonicWall in its Friday advisory. “Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.”
Neither SonicWall nor CISA has released further details about the reported attacks.
SonicWall said the flaw only impacts the SonicOS SSL VPN interface or service if SAML is enabled for SSL VPN logins. SAML (Security Assertion Markup Language) is an authentication standard that allows users to securely access multiple applications using a single login through an identity provider, enabling single sign-on (SSO). SAML can enforce MFA by requiring users to complete an additional verification step through their identity provider before granting access to an application. The vulnerability would enable attackers to circumvent those SAML-enforced controls, including bypassing MFA.
The flaw impacts SonicOS versions 8.2.2-8015 and older and 7.3.3-7015 and older. Fixed versions include 7.3.4-7013 and 8.2.3-8015, respectively. Ryan Harris of The Electronic Office was credited with reporting the flaw.
In 2026, there has been a recurring pattern of attackers targeting SonicWall’s remote-access products. In October, researchers said attackers attempted to exploit a critical vulnerability in SMA 1000 appliances (CVE-2026-102255); and in September SonicWall warned of two SMA 1000 flaws (CVE-2026-83549 and CVE-2026-83548) targeted in attacks.
Lindsey O’Donnell-Welch is an award-winning journalist who strives to shed light on how security issues impact not only businesses and defenders on the front line, but also the daily lives of consumers.
More from Lindsey →
