On SonicWall firewalls that use SAML for SSL VPN, attackers with stolen credentials could skip SAML checks — including MFA. Fixed firmware and what to do.
Publicly disclosed: 6 November 2026
On 6 November 2026 SonicWall warned about an exploited weakness in SonicOS SSL VPN. When SSL VPN logins are configured with SAML (for example through Microsoft Entra ID or Okta), an attacker who has valid credentials for another login method can bypass the SAML checks — and with them the MFA enforced by SAML. CISA added it to its exploited catalog the same day. There is no workaround.
| CVE | Severity | Affected | Fixed in |
|---|---|---|---|
CVE-2026-19868 | High, CVSS 7.1 (single-factor authentication) — exploited | SonicOS Gen7 7.3.3-7015 and earlier; Gen8 8.2.2-8015 and earlier — SSL VPN with SAML | Gen7 7.3.4-7013; Gen8 8.2.3-8015 |
MFA protects only when every login path enforces it.
Sources: BleepingComputer, 6 Nov 2026, CISA alert, 6 Nov 2026.
Need help with this? Contact CySec for a free consultation.
A newly disclosed exploit chain gives attackers root on on-premises N-central servers; attacks began hours after the proof of concept. No complete fix yet — immediate checks.
Read articleAn exploited Outlook flaw leaks NTLM password hashes from a crafted file. Microsoft fixed over 1,000 vulnerabilities this month — here is what to prioritise.
Read articleGoogle fixed a use-after-free in Chrome that is already exploited. The fix only works after the browser restarts — here is how to make sure every PC is protected.
Read articleOur engineers can review your current setup and propose concrete improvements.
