SonicWall Patches SonicOS SAML Bypass After Confirmed Exploitation
CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog and ordered federal remediation by November 20, 2026 because the bug lets valid alternate credentials bypass SAML-enforced multi-factor authentication.
Overview
- SonicWall issued patched SonicOS builds this week that fix CVE-2026-19868 and six other flaws, and the company is urging customers to upgrade immediately because no workaround is available.
- The vulnerability affects the SSL‑VPN service on SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier and is fixed in versions 7.3.4-7013 and 8.2.3-8015.
- CVE-2026-19868 is an authentication enforcement bug that can allow a user who already has valid credentials for an alternate authentication method to bypass SAML controls and SAML-enforced MFA.
- The U.S. Cybersecurity and Infrastructure Security Agency added the flaw to its KEV catalog, treating reported exploitation as confirmed and directing federal civilian agencies to remediate affected systems by November 20, 2026.
- The patch arrives during a run of 2026 attacks on SonicWall remote-access appliances, increasing the urgency for organizations to restrict internet access to management and VPN interfaces, rotate credentials, and boost logging and monitoring for misuse.