Loading vulnerability…
SAML Authentication and MFA Bypass in SonicWall SonicOS SSLVPN
CVE-2026-19868 is an authentication enforcement vulnerability in the SonicWall SonicOS SSLVPN service when SAML is enabled for SSLVPN logins. A user possessing valid credentials for an alternate authentication method may bypass SAML authentication controls, including potentially SAML-enforced multi-factor authentication. Affected releases include versions before 7.3.4-7013 and before 8.2.2-8015 in their respective release branches. The vulnerability is known to be exploited and was added to CISA's Known Exploited Vulnerabilities catalog on November 6, 2026.
What it means and what to do now: patch path, interim mitigations, and the assume-compromise checklist.
What an attacker gets, and what they’ve been doing with it.
An attacker with valid alternate-authentication credentials may establish SSLVPN access without satisfying the intended SAML authentication requirements or SAML-enforced MFA. This undermines the VPN authentication boundary and may expose resources accessible to the authenticated account. The published CVSS v3.1 assessment indicates high confidentiality impact, low integrity impact, and no availability impact.
If you can’t patch tonight, do this now.
Evaluate affected assets' internet exposure and apply mitigations according to SonicWall instructions. No specific configuration workaround is identified. If effective mitigations are unavailable, discontinue use of the affected product.
Patch, then assume compromise.
Upgrade SonicOS to version 7.3.4-7013 or 8.2.2-8015, as appropriate for the release branch, or a later vendor-supported fixed release. Prioritize affected deployments because exploitation is known. CISA's KEV entry specifies a remediation deadline of November 20, 2026, for organizations subject to the applicable requirements.
No public exploits tracked yet. Mallory keeps watching.
29 sources tracked across advisories, community write-ups, and news. New activity surfaces here as Mallory finds it.