SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
SonicWall patches SonicOS vulnerability CVE-2026-19868, potentially exploited to bypass SAML VPN authentication.
SonicWall has released a patch for SonicOS vulnerability CVE-2026-19868, which allows attackers with valid credentials for alternate authentication methods to bypass SAML authentication and potentially SAML-enforced MFA. The vulnerability, rated high severity with a CVSS score of 7.1, has been added to CISA's Known Exploited Vulnerabilities catalog, indicating potential exploitation in the wild. Affected devices include various SonicWall firewall models running older versions of SonicOS.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SonicWall?
Get an email when a new story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA high-severity vulnerability in SonicWall's SonicOS allowed attackers with valid credentials for alternate authentication methods to bypass SAML-enforced MFA, effectively neutralizing a critical security control protecting VPN access. The flaw was added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation before many organizations had applied the available patch. This incident underscores how perimeter security appliances — often trusted as gatekeepers — can become the weakest link when left unpatched. The bypass of MFA is particularly dangerous because it dismantles a defense-in-depth layer that organizations frequently rely on as a last line of protection against credential-based attacks.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-19868