SonicWall patches SAML authentication bypass flaw already reported exploited
Organisations running SonicOS SSL VPN with SAML login should upgrade now, since the flaw can skip SAML-enforced MFA and has no workaround.
SonicWall has released fixes for seven SonicOS flaws, one of which, CVE-2026-19868, lets someone holding valid credentials for an alternate login method get past SAML authentication, including SAML-enforced MFA. It carries a CVSS score of 7.1 and only matters on SSL VPN deployments that use SAML. SonicWall said it had investigated a report of exploitation and urged customers to move to the latest release, and CISA has listed the flaw in its Known Exploited Vulnerabilities catalog with a November 20 deadline for federal agencies. Two other flaws in the management interface, each rated 8.8, can be abused by a remote attacker without logging in under certain circumstances. The fixed versions are 7.3.4-7013 and 8.2.3-8015, and no workarounds exist.
Why it matters
The flaw lets someone with valid credentials for another login method get past SAML checks, including the multi-factor step that SAML can enforce, so a stolen password for a different method may be enough to reach VPN access. SonicWall has investigated a report of exploitation, and CISA has added the flaw to its catalog of known exploited vulnerabilities with a November 20 deadline for federal agencies. Because only the SAML configuration is affected and no workaround exists, the practical effect is that affected operators have no way to reduce exposure short of applying the fixed releases.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.