SonicWall patches actively exploited SSLVPN SAML multi-factor authentication bypass in SonicOS

Nov 9, 20261 min readEdition: 2026-11-09-cybersecurity-advisories

Topographic elevation contour card for SonicWall patches actively exploited SSLVPN SAML multi-factor authentication bypass in SonicOS — VISUAL ARTWORK:Original editorial artwork. Third-party brand marks used under nominative fair use.

What happened.SonicWall published security advisory SNWLID-2026-0014 resolving an actively exploited authentication enforcement flaw in the SonicOS SSLVPN service.

Why it matters.Perimeter firewalls protect corporate internal networks. When alternate login paths bypass multi-factor authentication, stolen directory credentials grant perimeter access. Network engineering teams must install SonicOS 7.3.4 or 8.2.3 immediately.

The technical specifications:

Vulnerability mechanics: Tracked as CVE-2026-19868 with a 7.5 CVSS score, an authentication enforcement defect allows users with valid alternate credentials to bypass SAML controls.
Exploitation impact: Attackers with directory or local credentials bypass SAML-enforced multi-factor authentication, reducing access to single-factor authentication.
Deployment scope: The defect affects firewalls with SSLVPN and SAML active on Gen 7 (SonicOS <= 7.3.3-7015) and Gen 8 (SonicOS <= 8.2.2-8015) appliances.
Active exploitation: SonicWall and CISA confirmed active exploitation, adding the vulnerability to the Known Exploited Vulnerabilities catalog.
Remediation releases: SonicWall released firmware updates, urging upgrades to SonicOS 7.3.4 for Gen 7 and SonicOS 8.2.3 for Gen 8.

TOPICS:

#security #vulnerability #firewall #vpn #critical-infrastructure #exploit-in-the-wild