A SonicWall VPN flaw can slip past SAML sign-in. CISA says it is being exploited.
By Lior AharonovFounder, 7IT Solutions ·
What happened
SonicWall fixed seven SonicOS flaws, including CVE-2026-19868, a CVSS 7.1 SSL-VPN bypass. With valid credentials for another sign-in method, an attacker can get around SAML controls, possibly SAML-enforced MFA. CISA added it to its exploited list on 6 November, with a federal deadline of 20 November, per BleepingComputer.
Why it matters
MFA is the lock you count on when a password leaks. If your VPN uses SAML, that lock may have a side door. SonicWall has shared no details on the attacks, and says there is no workaround.
What to do
If you run SonicOS with SAML on the SSL-VPN, upgrade today to Gen7 7.3.4-7013 or Gen8 8.2.3-8015. Then review VPN logins from the past weeks.
My take
Lior Aharonov
Founder, 7IT Solutions
MFA that can be sidestepped is a password with extra paperwork. Patch the VPN first, then ask who else shares that sign-in path.
Sources
| BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks | bleepingcomputer.com |
| CISA: Adds One Known Exploited Vulnerability to Catalog (6 November 2026) | cisa.gov |
Researched with AI tools; every fact is checked against the linked sources.