BleepingComputer reports attackers exploiting one of seven SonicWall SonicOS flaws, CVE-2026-19868, to bypass authentication on SSL-VPN. SonicWall says the flaw affects SSL-VPN only when Security Assertion Markup Language (SAML) is enabled for logins.
A user with valid credentials through another authentication method can enter without passing SAML’s sign-in checks; where SAML enforces multifactor authentication (MFA), that route can bypass MFA too. The advisory’s other six flaws have separate conditions and impacts, so this exploitation report concerns the authentication flaw, not the entire set.
For SonicWall deployments using SSL-VPN, SAML, and alternate login methods, the report puts the expected SAML/MFA gate in doubt for that access path. It does not identify affected customers or establish which accounts, if any, attackers reached, leaving the scope of any resulting exposure unclear.
CVSS 7.5 HIGH: an authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls.
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.