SonicWall SSL VPN flaw can bypass SAML checks, including MFA

CVE-2026-19868 affects the SSL VPN component of SonicOS on SonicWall firewalls. According to SecurityWeek, an attacker who already holds credentials for another authentication method may bypass SAML checks, including MFA applied through SAML. That prerequisite matters: assessing exposure requires examining the VPN’s available authentication methods and accounts, alongside its MFA settings.

Affected configurations and fixes

According to the vendor, SSL VPN is affected only when SAML-based login is enabled. The affected devices and versions are:

• Gen7 TZ, NSa, NSsp and NSv running SonicOS 7.3.3-7015 or earlier.
• Gen8 TZ, NSa and NSv running SonicOS 8.2.2-8015 or earlier.

SonicOS 7.3.4-7013 and 8.2.3-8015 fix the issue. No workaround is reported.

SonicWall said its product security team investigated a report indicating possible exploitation. CISA also added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, or KEV. These developments support prioritizing remediation, but do not establish that a particular organization’s system has been compromised.

TMGS recommendations

TMGS recommends recording device models, running SonicOS versions, SSL VPN status and whether SAML login is enabled. Review other authentication methods and accounts that remain authorized for remote access.

Before upgrading, TMGS recommends preparing configuration backups, a recovery plan and a maintenance window. After installing the appropriate fixed release, verify the running version and test login flows, including MFA. For outsourced firewall management, include configuration evidence and login test results in acceptance records, with clear responsibility for each check.

TMGS also recommends reviewing VPN and identity-system logs for unusual sessions. If credentials appear exposed, revoke sessions and change the relevant credentials under the incident response process. While awaiting maintenance, restrict VPN access sources and disable unused accounts where operationally appropriate. These measures reduce risk; remediation still requires patching.

Read the full analysis on TMGS: https://tmgs.vn/tin-tuc/mfa-qua-saml-co-the-bi-vuot-qua-tren-vpn-sonicwall-i.fe2aa743-d8d8-4739-8fd4-eb6cc7481824