SonicWall has released fixes for CVE-2026-19868, a SonicOS SSL-VPN flaw that can let an attacker with valid credentials for an alternate login method get past SAML authentication, including SAML-enforced multifactor authentication. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, confirming exploitation in the wild, and gave federal civilian agencies until November 20 to act, as summarized by Tech Bytes and WindowsForum.
The bug is rated 7.1 on the CVSS scale by SonicWall under advisory SNWLID-2026-0014, and it affects only SSL-VPN services configured to use SAML. On Gen 7 firewalls, SonicOS 7.3.3-7015 and older is affected and 7.3.4-7013 or later is fixed. On Gen 8, 8.2.2-8015 and older is affected and 8.2.3-8015 is fixed. Gen 6 and older firewalls have reached end of support and will not be patched.
SonicWall’s product security team investigated a report of potential exploitation and urged fast upgrades but has not published indicators of compromise, victim details or whether attacks began before disclosure. The company says no workaround exists, and the Canadian Centre for Cyber Security has also issued an advisory, AV26-1133.
Administrators should patch, check which alternate authentication methods are enabled alongside SAML on the SSL-VPN, look for VPN logins that did not pass through the identity provider and rotate credentials that could have been exposed. The same releases fix other SonicOS issues, including two management interface flaws rated 8.8 and pre-authentication buffer overflows, though only CVE-2026-19868 is listed as exploited.