# Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

DevFeed: [Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)](<https://devfeed.tech/articles/exploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-2026-19868-122990.md>)

Original publisher: [Read original article](<https://www.helpnetsecurity.com/2026/11/09/exploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-2026-19868/>)

Author: Zeljka Zorz

Published: 2026-11-09T10:30:25Z

Content type: news

Language: en

Sources: [Help Net Security](<https://devfeed.tech/sources/help-net-security.md>)

Topics: [saml](<https://devfeed.tech/topics/saml.md>), [MFA](<https://devfeed.tech/topics/mfa.md>), [known exploitable vulnerabilities](<https://devfeed.tech/topics/known-exploitable-vulnerabilities.md>), [Virtual Private Network](<https://devfeed.tech/topics/vpn.md>), [credential-based attacks](<https://devfeed.tech/topics/credential-based-attacks.md>), [Access Control](<https://devfeed.tech/topics/access-control.md>), [cve remediation](<https://devfeed.tech/topics/cve-remediation.md>), [Threat monitoring](<https://devfeed.tech/topics/threat-monitoring.md>), [ransomware](<https://devfeed.tech/topics/ransomware.md>)

Tags: [2026](<https://devfeed.tech/tags/2026.md>), [about](<https://devfeed.tech/tags/about.md>), [authentication](<https://devfeed.tech/tags/authentication.md>), [bypass](<https://devfeed.tech/tags/bypass.md>), [company](<https://devfeed.tech/tags/company.md>), [credentials](<https://devfeed.tech/tags/credentials.md>), [cve](<https://devfeed.tech/tags/cve.md>), [cve-2026-19868](<https://devfeed.tech/tags/cve-2026-19868.md>), [don-t-miss](<https://devfeed.tech/tags/don-t-miss.md>), [exploited](<https://devfeed.tech/tags/exploited.md>), [factor](<https://devfeed.tech/tags/factor.md>), [firewall](<https://devfeed.tech/tags/firewall.md>), [first](<https://devfeed.tech/tags/first.md>), [fixed](<https://devfeed.tech/tags/fixed.md>), [hot-stuff](<https://devfeed.tech/tags/hot-stuff.md>), [lets](<https://devfeed.tech/tags/lets.md>), [mfa](<https://devfeed.tech/tags/mfa.md>), [multi-factor-authentication](<https://devfeed.tech/tags/multi-factor-authentication.md>), [news](<https://devfeed.tech/tags/news.md>), [saml](<https://devfeed.tech/tags/saml.md>), [sonicwall](<https://devfeed.tech/tags/sonicwall.md>), [ssl](<https://devfeed.tech/tags/ssl.md>), [ssl-vpn](<https://devfeed.tech/tags/ssl-vpn.md>), [vpn](<https://devfeed.tech/tags/vpn.md>), [vulnerability](<https://devfeed.tech/tags/vulnerability.md>)

## AI overview

CVE-2026-19868 is an exploited SonicOS SSL-VPN authentication enforcement flaw that can let someone with valid alternate-method credentials bypass SAML login controls and any MFA enforced through SAML. It applies only when SAML is enabled for SSL-VPN logins; it is not an unauthenticated bypass. SonicWall fixed it in releases 7.3.4-7013 and higher and 8.2.3-8015, affecting Gen7 and Gen8 appliances on versions 7.3.3-7015 and older or 8.2.2-8015 and older. Gen6 is not listed as affected but is out of support; SonicWall advises upgrading Gen6 or older hardware to Gen8. No workarounds, attack details, or IoCs are provided. Organizations using SAML for VPN logins are advised to compare successful VPN logins with identity-provider sign-in and MFA logs, reset credentials for accounts with unmatched logins, and review what those sessions accessed. CISA added the flaw to its Known Exploited Vulnerabilities catalog; US civilian federal agencies must address it by November 20, 2026.

## Source excerpt

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins. According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass ... More -> The post Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) appeared first on Help Net Security.