Vulnerabilities · Identity
SonicWall fixes VPN flaw that let attackers bypass multi-factor authentication
SonicWall has patched a VPN vulnerability that let attackers bypass SAML-based multi-factor authentication. The flaw was exploited in attacks, and users are urged to update.
Ross Grant2 min read
The short version
SonicWall found and fixed a security problem in its firewall software that let attackers get around multi-factor authentication (MFA) on VPNs. This means someone could log in even if MFA was required. The problem only affects certain versions and settings. SonicWall and U.S. authorities say attackers have already used this bug, so users should update their systems right away.
By the numbers
- 7.1CVSS severity score for the MFA bypass flawBleepingComputer
- 8.8CVSS severity score for two management interface flaws also patchedBleepingComputer
- 20 November 2026CISA deadline for U.S. agencies to patch affected systemsBleepingComputer
What happened?
SonicWall has patched a vulnerability in its firewall software that let attackers bypass multi-factor authentication (MFA) on SSL-VPN services using SAML. The flaw (CVE-2026-19868) was exploited in attacks, according to SonicWall and CISA. Users are urged to update to the latest version. Only one outlet has reported this so far.
How the flaw works
SonicWall has patched a vulnerability in its SonicOS firewall software that allowed attackers to bypass SAML-based multi-factor authentication (MFA) on SSL-VPN services. The flaw, tracked as CVE-2026-19868, affects systems using SAML for authentication. Attackers with valid credentials for another authentication method could use this bug to get around SAML controls, including MFA. This means that even if an organisation required MFA, an attacker could still log in if they had a password for another method.
The vulnerability has a CVSS severity score of 7.1, which is considered high. It only affects SonicOS SSL-VPN services configured to use SAML authentication. No workaround is available, so patching is required.
Who is affected
The affected versions are SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015. The fixed versions are 7.3.4-7013 and 8.2.3-8015. Only systems using SAML authentication for SSL-VPN are vulnerable. SonicWall customers using these versions and configurations should update immediately.
The response
SonicWall released security updates to fix this and six other vulnerabilities. In its advisory, SonicWall said it had investigated a report of the vulnerability being exploited in attacks and urged customers to upgrade as soon as possible. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalogue, confirming that attackers have used it in the wild. CISA ordered U.S. federal agencies to secure affected systems by 20 November 2026.
The other patched flaws include two management interface bugs rated 8.8 severity, which could let unauthenticated attackers perform unauthorised operations under certain conditions. There are also buffer overflows that could cause denial-of-service, and a weak password hashing issue affecting virtual appliances.
Has this happened before?
SonicWall products have been targeted several times in recent months. In October, researchers saw attacks on another SonicWall vulnerability (CVE-2026-102255) that allowed unauthenticated access to internal functions. Earlier, attackers chained two zero-day vulnerabilities in SMA1000 appliances to run code remotely, and in July, two more zero-days were used to deploy malware.
Is there a fix?
SonicWall says the only fix is to update to the latest versions. There are no workarounds. Customers should check their systems and apply the updates as soon as possible.
Why it matters
This flaw let attackers bypass an important security step (MFA) that many organisations rely on to protect remote access. Attackers have already used it, so unpatched systems are at risk. The only way to stay safe is to update affected devices.
Key points
- SonicWall patched a VPN flaw that bypassed SAML-based MFA.
- Attackers have exploited this vulnerability in the wild.
- Only certain versions and SAML configurations are affected.
- There is no workaround; patching is required.
- CISA ordered U.S. agencies to update by 20 November 2026.
Sources
BleepingComputer
Reference
