Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

A security flaw has come to light in SonicWall SSL-VPN, with enough detail now public for defenders to act on it.

The affected service is reachable from the network without authentication.

SonicWall SSL-VPN may already be doing an ordinary job in your environment while also being reachable from a network an attacker can access.

Appliances like this often run untouched for months at a time, which is exactly why they're a favorite target.

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication.

The same SonicOS releases fix six other vulnerabilities, none of which have been flagged as exploited.

Anyone running SonicWall SSL-VPN 7.3.3-7015 is exposed, and because this is reachable without authentication, exposure doesn't depend on a user doing anything.

According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls and, with them, any MFA enforced through SAML.

In practice, that means a VPN login that should have gone through the organization’s identity provider (e.g., Okta or Microsoft Entra ID) and its MFA check can succeed with a password alone.

What an attacker actually gains: the advisory describes a real security impact once the vulnerable path is reached.

Being reachable without authentication is what moves this from 'patch eventually' to 'patch now' -- there's no login screen standing between an attacker and the vulnerable code.

But stolen VPN credentials are hardly in short supply, and SAML-enforced MFA is exactly the control many organizations rely on to make them useless for attackers.

This is tracked as CVE-2026-19868 -- use that identifier when checking vendor guidance or scanner results.

The affected versions are 7.3.3-7015, so that's the range to check against your own deployment.

CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins.

A workaround exists, but there is no complete fix available yet.

With no workarounds listed, the company has urged admins to patch quickly.

Fixes have been shipped in versions 7.3.4-7013 and higher, and v8.2.3-8015.

Confirm whether SonicWall SSL-VPN 7.3.3-7015 is present anywhere in your asset and software inventory.

No exploitation has been reported yet, but that status can change, so keep watching vendor guidance while you remediate.

Gen6 firewalls are not listed as affected, but they have reached the end-of-support stage, and SonicWall advises customers running those or older hardware to upgrade to a Gen8 firewall.