SonicWall patches SonicOS flaw that bypasses SAML MFA on VPN logins

SonicWall has released patches for a vulnerability in its SonicOS operating system that can allow attackers with valid alternate credentials to bypass SAML authentication, including SAML-enforced multi-factor authentication, on SSL VPN connections.

The flaw, tracked as CVE-2026-19868, affects the SSL VPN component when SAML-based login is enabled. It carries a CVSS score of 7.1 and was disclosed in an advisory published November 6. SonicWall credited researcher Ryan Harris with reporting the issue and stated that its security team investigated indications of potential exploitation in the wild.

According to the vendor advisory, successful exploitation requires an attacker to possess valid credentials for a different authentication method configured on the device. The bypass specifically targets the enforcement of SAML controls. SonicWall has made fixes available through its PSIRT channel for affected SonicOS versions.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities catalog. Federal agencies have until November 20 to apply the patches under Binding Operational Directive requirements.

Organizations using SonicWall firewalls with SAML-configured SSL VPN access should review the advisory, confirm exposure, and prioritize patching. The issue highlights ongoing risks in VPN infrastructure where authentication enforcement gaps can undermine MFA protections even when alternate login paths exist.

SonicWall customers are advised to apply the updates promptly and monitor for any unusual authentication activity on exposed VPN endpoints.

Sources

• psirt.global.sonicwall.com
• www.securityweek.com
• nvd.nist.gov

Cover photo by Jakub Zerdzicki on Pexels, used under the Pexels License.