SonicWall SSL-VPN flaw lets alternate credentials bypass SAML and MFA
SonicWall says attackers can bypass SAML authentication—and any SAML-enforced MFA—on SSL-VPN by logging in with valid credentials for another authentication method; researcher Ryan Harris reported the flaw.
- Affected
- SonicOS 7.3.3-7015 and older versions; SonicOS 8.2.2-8015 and older versions
- Fixed
- SonicOS 7.3.4-7013; SonicOS 8.2.3-8015
The issue affects only SonicOS SSL-VPN services configured to use SAML authentication and carries CVSS severity 7.1. CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog and ordered federal civilian agencies to secure affected systems by November 20, 2026; SonicWall investigated an exploitation report but shared no details.
Affected versions are SonicOS 7.3.3-7015 and older, and SonicOS 8.2.2-8015 and older. Fixed versions are 7.3.4-7013 and 8.2.3-8015, and SonicWall says no workarounds are available, so customers should install the latest security updates.
Sources & technical scope 3 sources
BleepingComputer — original source ↗
sonicwall CNA / CVE Program — original source ↗
sonicwall CNA / CVE Program — original source ↗
Affected: SonicOS 7.3.3-7015 and older versions; SonicOS 8.2.2-8015 and older versions
Fixed: SonicOS 7.3.4-7013; SonicOS 8.2.3-8015
Exploitation: Known exploited vulnerability per CISA KEV; SonicWall investigated an exploitation report but shared no details
Scope & limitations: Exploitation details are not publicly disclosed; individually tested versions are not established by the supplied evidence; no workarounds exist per SonicWall.
External findings belong to the credited researchers.