SonicWall MFA Bypass Flaw Exploited in the Wild
Written by AI from the linked story. Not reviewed by an editor. How this works
CVE-2026-19868 exposes a critical flaw in SonicWall's SSL-VPN implementation where attackers holding valid but stolen credentials can completely bypass SAML-enforced multi-factor authentication, reducing MFA to a false sense of security. This matters because MFA is widely regarded as one of the most effective controls against credential-based attacks — when it can be bypassed at the authentication layer itself, an entire tier of defence collapses. The vulnerability affects Gen7 and Gen8 firewall appliances and is already being actively exploited, meaning organisations that have not patched are exposed right now. CISA's inclusion in the Known Exploited Vulnerabilities (KEV) catalogue underscores the urgency, as real-world threat actors are leveraging this gap. Delayed patching of internet-facing network appliances like VPN gateways is especially dangerous because they sit at the perimeter and authenticate every remote user.
Tactical Insight
Immediate actions
- Apply SonicWall's patch for CVE-2026-19868 immediately on all affected Gen7 and Gen8 appliances, treating it as an emergency change.
- Cross-reference your asset inventory against CISA's KEV catalogue on a recurring basis and escalate any matches to priority-one patching status.
- Review VPN authentication logs for anomalous single-factor logins or SAML assertion failures that may indicate prior exploitation.
Long-term improvements
- Maintain a complete, up-to-date inventory of all internet-facing network appliances, including firmware versions, so patch applicability can be assessed within hours of a disclosure.
- Implement network segmentation so that even a successfully authenticated VPN session lands in a restricted zone requiring additional authorisation to reach sensitive systems.
- Adopt a Zero Trust architecture where continuous, context-aware verification replaces perimeter-only authentication checks.
Detection measures
- Deploy centralised SIEM alerting on VPN authentication events that succeed without a valid MFA claim or SAML assertion.
- Configure automated vulnerability scanning to target internet-facing appliances daily and alert on unpatched critical CVEs within 24 hours of publication.