Any SonicWall firewall running SAML login for SSL VPN needs the latest firmware, after the vendor confirmed a report of exploitation and federal authorities added the flaw to their must-patch list.
A bypass that also skips MFA
CVE-2026-19868 is an authentication enforcement bug in the SonicOS SSL VPN service. Someone with valid credentials for a different login method can slip past SAML checks, and possibly past SAML-enforced multifactor authentication. The flaw sits in the gap between two login paths that should not be interchangeable.
It is one of seven issues in an advisory published November 6. SonicWall said its product security team investigated a report of possible exploitation. Neither the vendor nor the authorities have described the attacks, and it is unclear whether the flaw was used before a patch existed. The CVSS score is 7.1 on the vendor page.
Who is affected and what closes it
Exposure requires SAML-based login on the VPN. Affected hardware covers seventh-generation TZ, NSa, NSsp and NSv appliances at SonicOS 7.3.3-7015 or older, plus eighth-generation TZ, NSa and NSv units at 8.2.2-8015 or older. Versions 7.3.4-7013 and 8.2.3-8015 fix it, with no workaround listed.
Two other flaws in the advisory, both scored 8.8, hit the management interface: a permissive cross-domain policy problem and a session validation bug. Under some conditions an unauthenticated remote attacker could abuse either. Neither is marked as exploited.
What defenders should do
Inventory firewalls and confirm which have SAML enabled for the SSL VPN, since those are the only exposed systems. Patch, then hunt logs for VPN sessions authenticated through a non-SAML path from unusual sources. The bypass needs no exploit chain, so a stolen or guessed credential from any alternate method is enough. Rotate secondary credentials and review locally defined VPN accounts in the same window.
