Anyone holding a working password could walk past a SonicWall SSL-VPN gateway and never touch SAML. Attackers are already doing it. The vendor is investigating reports of exploitation against CVE-2026-19868, and CISA added the flaw to its Known Exploited Vulnerabilities catalog with a November 20 deadline for civilian federal agencies.
The bug lives in SonicOS authentication enforcement. With SAML enabled for VPN logins, a user holding credentials for a different, still-active method can finish signing in without the identity provider ever seeing it. MFA enforced through SAML, typically Okta or Entra ID, does not apply.
No workaround exists, so patching is the only exit.
Who is exposed right now
Gen7 and Gen8 appliances at firmware 7.3.3-7015 or older and 8.2.2-8015 or older carry it. Fixed builds are 7.3.4-7013 and v8.2.3-8015, which also close six unflagged bugs.
Gen6 hardware is absent only because it is past end of support, not because it is safe. SonicWall wants those customers on Gen8.
Ryan Harris of Electronic Office found this one. It is not the platform’s first MFA gap: attackers abused CVE-2024-12802, another VPN path around MFA, and Akira affiliates spent 2025 inside firewalls already running one-time-password MFA.
What defenders should grep for
No indicators of compromise have been published and no vendor has described the intrusions, so detection comes from identity logs, not signatures.
Pull recent VPN sessions and hunt for successful logins with no matching sign-in and MFA challenge at the identity provider. That mismatch is the attack in one line. Reset those passwords, then review where the sessions went.
Stolen credentials are the sole prerequisite, and infostealer markets have no shortage of VPN logins. Treat the identity provider as the source of truth and the VPN log as the claim being tested.
