SonicWall SonicOS SSLVPN Flaw Exploited to Bypass SAML Authentication Controls
Active Exploitation · 4 sources · Updated 57m ago · First seen Nov 6, 2026
SonicWall reports active exploitation of CVE-2026-19868, a single-factor authentication vulnerability in SonicOS SSLVPN. An attacker with valid credentials for an alternate authentication method may bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026; its use in ransomware campaigns is listed as unknown.
The Canadian Centre for Cyber Security’s advisory AV26-1133 identifies affected SonicOS versions as those earlier than 7.3.4-7013 and 8.2.2-8015 and urges administrators to review vendor advisories and apply necessary updates as they become available. CISA’s catalog entry sets a November 20, 2026 remediation deadline and directs stakeholders to apply vendor mitigations and follow BOD 26-04 guidance. Organizations running affected SSLVPN deployments should prioritize remediation given the reported exploitation and potential bypass of SAML-enforced MFA.
