--- title: SonicWall warns of new SSL-VPN MFA bypass flaw exploited... description: SonicWall has patched seven SonicOS vulnerabilities, including an SSL-VPN flaw already exploited in attacks. CVE-2026-19868 lets attackers with valid... canonical: https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93 twitter:card: summary_large_image twitter:site: @dailydotdev og:type: website og:site_name: daily.dev og:title: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks | daily.dev og:description: SonicWall has patched seven SonicOS vulnerabilities, including an SSL-VPN flaw already exploited in attacks. CVE-2026-19868 lets attackers with valid... og:url: https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93 og:image: https://api.daily.dev/og/posts/2lnsXah93.png og:image:alt: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks og:image:width: 1200 og:image:height: 630 og:locale: en --- > ## Documentation Index > Fetch the complete documentation index at: https://daily.dev/llms.txt > Use this file to discover all available pages before exploring further. # SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks **[BleepingComputer](https://daily.dev/sources/bleepingcomputer)** · 3 min read · 0 upvotes · 0 comments ## Summary SonicWall has patched seven SonicOS vulnerabilities, including an SSL-VPN flaw already exploited in attacks. CVE-2026-19868 lets attackers with valid credentials for an alternate login method bypass SAML authentication, potentially skipping SAML-enforced MFA. It carries a CVSS score of 7.1 and only affects SSL-VPN services using SAML. CISA added it to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 20, 2026. The advisory also fixes two 8.8-severity management interface bugs, pre-auth buffer overflows, and a weak password hashing issue. Affected versions are Gen7 7.3.3-7015 and Gen8 8.2.2-8015 and earlier; fixes are in 7.3.4-7013 and 8.2.3-8015, with no workarounds available. ## Full article daily.dev links to this article rather than hosting it. Read it at the original source: ## Questions this post answers ### What is CVE-2026-19868 and how does it bypass SAML MFA on SonicWall SSL-VPN? CVE-2026-19868 is a SonicOS SSL-VPN authentication bypass that lets an attacker with valid credentials for an alternate authentication method skip SAML authentication controls, potentially including SAML-enforced multi-factor authentication. It has a CVSS score of 7.1, only affects SSL-VPN configured for SAML, and is already listed in CISA's Known Exploited Vulnerabilities catalog. _Teams tracking actively exploited VPN flaws can follow fixes like this one on daily.dev._ ### Which SonicOS versions fix the SSL-VPN SAML authentication bypass vulnerability? SonicWall fixed CVE-2026-19868 and six other SonicOS vulnerabilities in versions 7.3.4-7013 and 8.2.3-8015. The flaws affect Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier, and SonicWall says no workarounds exist, so upgrading is the only mitigation. _Admins planning firewall patch cycles can track SonicWall advisories like this via daily.dev._ ### What is the deadline for federal agencies to patch the SonicWall SSL-VPN MFA bypass flaw? CISA ordered federal civilian executive branch agencies to secure systems affected by CVE-2026-19868 by November 20, 2026, after confirming the vulnerability was exploited in the wild and adding it to the Known Exploited Vulnerabilities catalog. _Security teams juggling KEV deadlines can keep up with advisories like this on daily.dev._ ## Similar posts on daily.dev - [Beyond the Patch: Understanding the SonicWall SSL-VPN MFA Bypass Exposure](https://daily.dev/posts/beyond-the-patch-understanding-the-sonicwall-ssl-vpn-mfa-bypass-exposure-oyurx5iv5) · InfoSec Write-ups · 0 upvotes · 0 comments - [Hackers bypass SonicWall VPN MFA due to incomplete patching](https://daily.dev/posts/hackers-bypass-sonicwall-vpn-mfa-due-to-incomplete-patching-6ef76rsqe) · BleepingComputer · 0 upvotes · 0 comments - [SonicWall CVE-2024-40766 Proves Patching Is Not Remediation](https://daily.dev/posts/sonicwall-cve-2024-40766-proves-patching-is-not-remediation-nw4rlw8je) · Latest Hacking News · 0 upvotes · 0 comments - [CISA: SonicWall SMA1000 flaws now exploited by ransomware gangs](https://daily.dev/posts/cisa-sonicwall-sma1000-flaws-now-exploited-by-ransomware-gangs-x9e9rvfsr) · BleepingComputer · 0 upvotes · 0 comments --- Tags: [#security](https://daily.dev/tags/security), [#authentication](https://daily.dev/tags/authentication), [#vpn](https://daily.dev/tags/vpn) [View this post on daily.dev](https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93) ```json {"@context":"https://schema.org","@graph":[{"@type":"Organization","@id":"https://daily.dev/#organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180},"sameAs":["https://twitter.com/dailydotdev","https://github.com/dailydotdev","https://www.linkedin.com/company/daily-dev-ltd"]},{"@type":"WebSite","@id":"https://daily.dev/#website","url":"https://daily.dev","name":"daily.dev","publisher":{"@id":"https://daily.dev/#organization"},"potentialAction":{"@type":"SearchAction","target":{"@type":"EntryPoint","urlTemplate":"https://daily.dev/search?q={search_term_string}"},"query-input":"required name=search_term_string"}}]} {"@context":"https://schema.org","@type":"TechArticle","headline":"SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks","url":"https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93","mainEntityOfPage":{"@type":"WebPage","@id":"https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93"},"datePublished":"2026-11-07T00:04:45.073Z","dateModified":"2026-11-07T00:05:13.384Z","description":"SonicWall has patched seven SonicOS vulnerabilities, including an SSL-VPN flaw already exploited in attacks. CVE-2026-19868 lets attackers with valid...","image":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4561b448df80b1ccb1325412776874bf?_a=AQAEuop","thumbnailUrl":"https://media.daily.dev/image/upload/f_auto,q_auto/v1/posts/4561b448df80b1ccb1325412776874bf?_a=AQAEuop","isAccessibleForFree":true,"articleSection":"BleepingComputer","inLanguage":"en","publisher":{"@type":"Organization","name":"daily.dev","url":"https://daily.dev","logo":{"@type":"ImageObject","url":"https://daily.dev/apple-touch-icon.png","width":180,"height":180}},"author":{"@type":"Organization","name":"BleepingComputer","logo":"https://media.daily.dev/image/upload/s--as8nJ3qy--/f_auto,q_auto/v1774959951/logos/bleepingcomputer?_a=BAMAMiWQ0","url":"https://daily.dev/sources/bleepingcomputer"},"commentCount":0,"discussionUrl":"https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93","interactionStatistic":[{"@type":"InteractionCounter","interactionType":{"@type":"LikeAction"},"userInteractionCount":0},{"@type":"InteractionCounter","interactionType":{"@type":"CommentAction"},"userInteractionCount":0}],"keywords":"security,authentication,vpn","timeRequired":"PT3M"} {"@context":"https://schema.org","@type":"BreadcrumbList","itemListElement":[{"@type":"ListItem","position":1,"name":"Home","item":"https://daily.dev"},{"@type":"ListItem","position":2,"name":"BleepingComputer","item":"https://daily.dev/sources/bleepingcomputer"},{"@type":"ListItem","position":3,"name":"SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks"}]} {"@context":"https://schema.org","@type":"FAQPage","@id":"https://daily.dev/posts/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-2lnsxah93#faq","mainEntity":[{"@type":"Question","name":"What is CVE-2026-19868 and how does it bypass SAML MFA on SonicWall SSL-VPN?","acceptedAnswer":{"@type":"Answer","text":"CVE-2026-19868 is a SonicOS SSL-VPN authentication bypass that lets an attacker with valid credentials for an alternate authentication method skip SAML authentication controls, potentially including SAML-enforced multi-factor authentication. It has a CVSS score of 7.1, only affects SSL-VPN configured for SAML, and is already listed in CISA's Known Exploited Vulnerabilities catalog. Teams tracking actively exploited VPN flaws can follow fixes like this one on daily.dev."}},{"@type":"Question","name":"Which SonicOS versions fix the SSL-VPN SAML authentication bypass vulnerability?","acceptedAnswer":{"@type":"Answer","text":"SonicWall fixed CVE-2026-19868 and six other SonicOS vulnerabilities in versions 7.3.4-7013 and 8.2.3-8015. The flaws affect Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier, and SonicWall says no workarounds exist, so upgrading is the only mitigation. Admins planning firewall patch cycles can track SonicWall advisories like this via daily.dev."}},{"@type":"Question","name":"What is the deadline for federal agencies to patch the SonicWall SSL-VPN MFA bypass flaw?","acceptedAnswer":{"@type":"Answer","text":"CISA ordered federal civilian executive branch agencies to secure systems affected by CVE-2026-19868 by November 20, 2026, after confirming the vulnerability was exploited in the wild and adding it to the Known Exploited Vulnerabilities catalog. Security teams juggling KEV deadlines can keep up with advisories like this on daily.dev."}}]} ```