SonicOS SSLVPN SAML bypass actively exploited (CVE-2026-19868)

Actively exploited in the wild - CVE-2026-19868 is a high-severity authentication bypass in the SonicWall SonicOS SSLVPN service that lets an attacker holding valid credentials for any alternate authentication method skip SAML enforcement entirely, including SAML-enforced multi-factor authentication. Treat every SSLVPN endpoint on an affected firmware as exposed; apply the vendor’s fix or disable alternate authentication methods immediately.

Overview

SonicOS normally lets administrators chain authentication methods during SSLVPN login, for example local accounts, RADIUS or LDAP alongside SAML. CVE-2026-19868 breaks the enforcement logic: when a user presents valid credentials for an alternate method, the appliance accepts the session without ever validating the SAML assertion. The SAML step, and any MFA policy bound to it, is simply not applied.

The practical result is that the strongest control in the login chain can be bypassed by the weakest credential set on the box. If a stale local account, a shared RADIUS login, or a lightly protected LDAP credential exists anywhere on the appliance, that account becomes a route past SAML and past MFA. CVSS scores this 7.5 with high attack complexity, but the complexity is an attacker’s problem, not a defender’s: the exploit path is a login, not a memory corruption chain.

Impact

Successful exploitation grants an authenticated SSLVPN session on the firewall. From there an attacker sits inside the network perimeter with the same tunnel access the legitimate account was entitled to. Because MFA was bypassed, stolen or guessed credentials that would otherwise be useless become fully usable. On an edge appliance this is a direct path into internal segments, and it is exactly the kind of access that precedes ransomware staging and lateral movement. CISA has confirmed active exploitation, so this is not a theoretical weakness being picked up by scanners.

Remediation and mitigation

• Apply the current SonicWall SonicOS firmware release that addresses CVE-2026-19868. Confirm the fix version against the vendor advisory before upgrading, and check HA pairs so both nodes are updated.
• If you cannot patch immediately, disable alternate authentication methods on the SSLVPN and require SAML as the sole path, or restrict SSLVPN access to trusted source ranges.
• Audit local and directory accounts that can reach SSLVPN. Remove stale, shared, and service-style logins that could serve as the alternate method.
• Review SSLVPN authentication logs for sessions established without a corresponding SAML assertion, and force re-authentication of active sessions after upgrading.
• Rotate credentials for any account with SSLVPN access that may have been exposed.

Data breach reports are tracked at breach reports, and ongoing coverage of this campaign is available at security news.

Security Insight

SonicWall’s SSLVPN has now produced a steady sequence of authentication and pre-auth memory bugs, and this one is notable because it is a logic failure rather than a parsing flaw: the code let a fallback path quietly outrank the primary control. That pattern is common in appliances that accumulated authentication methods over years, where each new option was bolted onto an existing decision tree instead of replacing it. For defenders, the lesson is that MFA is only as strong as the weakest identity path that reaches the same door, and mapping every path matters as much as enabling SAML.

Further Reading

• All High Vulnerabilities
• Recent Critical Vulnerabilities
• Top Critical CVEs