SonicWall Patches Exploited VPN Authentication Bypass

CISA added CVE-2026-19868 to its exploited vulnerabilities list. The flaw affects SonicOS SSL VPN deployments that use SAML for sign-ins.

Editorial Staff

November 9, 2026

1–2 minutes

CISA, Cybersecurity, MFA, VPN, Vulnerabilities

CISA added CVE-2026-19868 to its exploited vulnerabilities list. The flaw affects SonicOS SSL VPN deployments that use SAML for sign-ins.

Servers and network security appliances stacked in a data centre rack. — Servers and network security equipment in a data centre. Illustrative photograph. Photo by Aaron Hall, CC BY-SA 2.0. Cropped and resized.

SonicWall has released firewall updates for an SSL VPN authentication bypass that the US Cybersecurity and Infrastructure Security Agency has listed as exploited. CISA added the flaw, tracked as CVE-2026-19868, to its Known Exploited Vulnerabilities catalog on November 6.

The vulnerability affects SonicOS SSL VPN services configured to use Security Assertion Markup Language, or SAML, for sign-ins. SAML lets the VPN rely on a separate identity provider to authenticate users. Organisations can use that identity provider to enforce multi-factor authentication.

Where the bypass applies

A person who already holds valid credentials for an alternate authentication method can bypass SAML controls on an affected service, potentially bypassing multi-factor authentication enforced through SAML. SonicWall rated the flaw 7.1 out of 10 and said its security team investigated a report of possible exploitation. CISA’s listing establishes that the flaw has been exploited in the wild.

The vendor advisory lists fixes in SonicOS 7.3.4-7013 or later for affected Gen7 firewalls and 8.2.3-8015 or later for affected Gen8 firewalls. It lists no workaround. The model and firmware tables in the advisory identify which physical and virtual firewalls are covered.

What the listing changes

US federal civilian executive branch agencies have until November 20 to remediate the vulnerability under CISA’s directive. The catalog also gives other organisations a reason to prioritise the update for exposed services, particularly where SAML provides an additional authentication check.

The same SonicWall advisory covers six other issues, including flaws in the management interface and conditions that could interrupt network services. For teams responsible for remote access, the immediate task is to identify affected installations and install the model-specific update. The published advisory and catalog entry give administrators a way to confirm that the change addresses this specific vulnerability.