BLOG POST
SonicWall SSL VPN bypass puts alternate login paths under scrutiny
Jawed Ahmad ·
On November 6, SonicWall disclosed CVE-2026-19868, an authentication enforcement flaw in SonicOS SSL VPN. A user with valid credentials for an alternate authentication method may bypass SAML controls, including MFA enforced through SAML. The issue applies to SSL VPN services configured for SAML. The Canadian Centre for Cyber Security reported that CISA added the vulnerability to its Known Exploited Vulnerabilities catalog the same day. SonicWall CVE record · Canadian Cyber Centre advisory
What is known about exploitation
SonicWall says its product security team investigated a report of potential exploitation. The vendor statement quoted by BleepingComputer does not give a victim count, an exploitation timeline, or indicators that defenders can use to identify affected sessions. The KEV listing makes remediation a priority. Each organization still needs its own evidence to establish whether a gateway was compromised. SonicWall advisory · BleepingComputer reporting
What to check today
Inventory the gateways and verify the running build. Start with externally reachable Gen 7 and Gen 8 firewalls that offer SAML-based SSL VPN. SonicWall’s CVE record lists Gen 7 build 7.3.3-7015 and earlier and Gen 8 build 8.2.2-8015 and earlier as affected. The reported fixed builds are 7.3.4-7013 and 8.2.3-8015, respectively. Verify the target build for each appliance against the vendor advisory, then confirm the running build on every node after the upgrade. SonicWall CVE record · BleepingComputer reporting
Compare VPN sessions with identity-provider events. Preserve available gateway authentication and session logs, then look for successful VPN sessions that cannot be reconciled with expected identity-provider sign-ins or MFA events. Where logs permit, compare authentication method, account, source address, and timestamp. Clock skew, missing telemetry, and approved alternate login paths can all explain a mismatch. Use the mismatch to prioritize investigation and check what the session reached after login.
Test the policy from the VPN side. After patching, use controlled accounts to verify that alternate authentication paths cannot grant access where policy requires SAML and MFA. A successful MFA test through the normal identity-provider flow only tells you that one path works. This disclosure shows why the gateway’s other accepted login paths belong in the same test.