SonicWall patches exploited SonicOS SSL-VPN MFA bypass flaw

· Cybersecurity

SonicWall released security updates fixing seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw that the company says has been exploited in attacks, according to SecurityWeek and BleepingComputer. The flaw, tracked as CVE-2026-19868, can let attackers who already hold credentials for a different login method get past SAML checks, including SAML-enforced multi-factor authentication. That makes it a meaningful strengthening of an attacker's position once any credential is obtained, rather than a standalone break-in path. Firewall and VPN appliances remain a favored target because compromising them gives attackers a foothold at the network edge. Administrators are being urged to apply the updates; those who cannot patch immediately face exposure on internet-facing SSL-VPN services where remote access is enabled.

Why it matters：Edge appliances like VPN gateways are where enterprise access is decided, so a bypass that defeats SAML-enforced MFA weakens the identity controls many organizations rely on as their primary perimeter.

Key points

  • CVE-2026-19868 lets attackers bypass SAML checks, including SAML-enforced MFA.
  • The update addresses seven vulnerabilities in SonicOS in total.
  • The flaw is confirmed as exploited in the wild.

Sources (original reporting)

More stories from this day