SonicWall has patched CVE-2026-19868, a SonicOS SSL-VPN flaw that can let someone with valid credentials for a different login method bypass SAML authentication, including SAML-enforced MFA, SecurityWeek reports. SonicWall says it investigated a report of possible exploitation, and CISA added it to its Known Exploited Vulnerabilities catalog the same day, with a Nov. 20 deadline for federal agencies.
Are you affected?
- Only SSL-VPN setups with SAML login enabled are exposed to this bug. CVSS 7.1.
- Gen7 TZ, NSa, NSsp and NSv on SonicOS 7.3.3-7015 or older.
- Gen8 TZ, NSa and NSv on SonicOS 8.2.2-8015 or older.
What to do
Update to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8) now. There’s no workaround. The same advisory fixes six other flaws, so update even if you don’t use SAML. While you’re in there, review which accounts can still log in to the VPN without SAML.
My take
Another VPN bug that turns MFA into a speed bump. Patch today, not this weekend.
God Bless, and May the Source Be with You!
