Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)

CVE-2026-19868 exposes a critical flaw in SonicWall's SSL-VPN implementation where attackers holding valid but stolen credentials can completely bypass SAML-enforced multi-factor authentication, reducing MFA to a false sense of security. This matters because MFA is widely regarded as one of the most effective controls against credential-based attacks — when it can be bypassed at the authentication layer itself, an entire tier of defence collapses. The vulnerability affects Gen7 and Gen8 firewall appliances and is already being actively exploited, meaning organisations that have not patched are exposed right now. CISA's inclusion in the Known Exploited Vulnerabilities (KEV) catalogue underscores the urgency, as real-world threat actors are leveraging this gap. Delayed patching of internet-facing network appliances like VPN gateways is especially dangerous because they sit at the perimeter and authenticate every remote user.