SonicWall fixes an exploited flaw that allows bypassing SAML authentication on its SSL-VPN

SonicWall has released updates for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN flaw that, according to the company, has been exploited in an attack, BleepingComputer reports. The vulnerability, CVE-2026-19868, allows an attacker with valid credentials for another authentication method to bypass SAML controls, in some cases including the multi-factor authentication enforced by SAML.

According to that outlet, the flaw has a severity score of 7.1 and only affects SSL-VPN services configured with SAML authentication. SonicWall says in its advisory that it investigated a report indicating potential exploitation and urges customers to update as soon as possible; there are no workarounds.

The US Cybersecurity and Infrastructure Security Agency (CISA) has added the vulnerability to its catalog of exploited flaws and has given federal civilian agencies until November 20 to secure their systems, according to BleepingComputer. SonicWall has not given details of the attack.

Developing story: neither the SonicWall advisory nor the CISA catalog could be opened; the information so far comes from a single specialist outlet.