SonicWall Fixes an Exploited VPN Route Around SAML
SonicWall has released SonicOS fixes for a flaw that can let someone with valid credentials for a different login method bypass SAML enforcement on the SSL VPN. That can also bypass multi-factor authentication enforced by the SAML identity provider. CISA added the flaw to its Known Exploited Vulnerabilities catalogue today. CVE-2026-19868 · SonicWall advisory · CISA catalogue
Check which logins the VPN accepts
The attack requires valid credentials for an alternate authentication method. That makes the VPN’s effective login configuration important. Identify reachable SSL VPN endpoints configured for SAML and inventory other accepted authentication paths. When reviewing past logins, compare gateway sessions against identity-provider events. An unexpected VPN session with no corresponding SAML authentication is worth investigating alongside source addresses, the account involved and subsequent activity. SonicWall’s technical record
Verify the exact appliance build
SonicWall lists Gen7 builds through 7.3.3-7015 and Gen8 builds through 8.2.2-8015 as affected. The fix is available in Gen7 7.3.4-7013 and Gen8 8.2.3-8015. Check both members of a high-availability pair after upgrading and test that the intended SAML and MFA policy still applies. CISA set 20 November as the deadline for covered US federal agencies. SonicWall advisory · CISA catalogue
