SonicWall patches an SSL-VPN flaw that bypasses SAML and was exploited

What happened

• SonicWall released updates fixing seven vulnerabilities in SonicOS firewalls.
• One is an SSL-VPN authentication bypass, tracked as CVE-2026-19868, that may have been exploited in attacks.
• The flaw lets an attacker with valid credentials for an alternate authentication method bypass SAML controls, potentially including SAML-enforced multifactor authentication.
• It scores 7.1 on CVSS and only affects SonicOS SSL-VPN services configured with SAML.
• The advisory was published on Friday 6 November 2026; Ryan Harris of The Electronic Office discovered and reported the flaw.

Why it matters

SSL-VPN is the door through which staff enter an organization’s network from outside. If an attacker can skip multifactor authentication, the defense many firms consider sufficient stops being so at that point. The condition, valid credentials for another method, limits the risk but does not remove it, since stolen credentials are the start of many attacks. SonicWall said it investigated a report of potential exploitation, gave no details, and urged users to update.

The number

7 fixes, 1 exploited. The update covers seven SonicOS flaws; the advisory urges patching because of the exploitation report on CVE-2026-19868.

Context

The affected setup is specific: SSL-VPN with SAML. Those not using it are not exposed to this flaw, though it is worth checking the configuration before assuming. The advisory does not say who the attackers were or how many devices were hit. Related coverage: QNAP confirms attackers are breaking into its NAS devices with the Plex2Shell flaw chain, An oversized password opens no-password Linux accounts with OpenSSH and musl, The United States warns of attacks on industrial refrigerators and cold chains, Chainalysis admits a breach exposed credentials and tokens for all its users.

SAML is a standard that lets an external service, such as the company’s identity system, confirm who the user is before opening the VPN. If the device also accepts other authentication methods, such as a local directory, the combination can leave paths that skip the controls the administrator believed were active. A useful review is to leave a single remote-access method enabled and disable the others.

What’s next

• Administrators should install the fixed SonicOS release and review SSL-VPN access logs.
• Where possible, require an extra factor outside SAML for remote access.
• SonicWall may expand the advisory with indicators of compromise.

Bottom line

Multifactor authentication lowers risk, but it depends on nobody finding a way around it. This time the path lay in combining two access methods.

Sources

• BleepingComputer, “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks”, 6 November 2026, relying on SonicWall’s security advisory. The company’s page was not read directly.
• Cover image: cogdogblog, CC0, via Wikimedia Commons

Edited by Rodrigo Cornejo. How we select and verify: who writes these notes.