SonicWall said it fixed seven flaws in SonicOS, the software on its firewalls. One, CVE-2026-19868, sits in the SSL-VPN service, which handles remote logins. If SAML single sign-on is turned on, someone with a valid login for another method can get past SAML's checks. That may include the multi-factor authentication (MFA) step SAML enforces. The flaw has a CVSS severity score of 7.1. BleepingComputer reported the advisory came out on Friday.
SonicWall said it investigated a report of possible exploitation, but BleepingComputer said it gave no details of the attack. BleepingComputer added that CISA put the flaw on its known-exploited list, and federal civilian agencies must secure systems by November 20, 2026. The sources do not say how attackers got a valid login. Gen7 versions up to 7.3.3-7015 and Gen8 versions up to 8.2.2-8015 are affected. Installing 7.3.4-7013 or 8.2.3-8015 is the fix, and BleepingComputer says SonicWall offers no stopgap.
MFA is only as strong as the weakest login path left on. SonicWall's advisory labels this flaw use of single-factor authentication. Turning on SAML did not close other login paths, so one valid credential could be enough. A security lead could check whether alternate logins, such as local accounts, are enabled on the VPN, and review VPN logs for logins that skipped SAML.