CVE-2026-19868 – SAML Bypass in SonicOS SSLVPN

CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSLVPN service that allows bypassing SAML authentication controls and MFA verification. An attacker with valid credentials for an alternate authentication method can circumvent SAML-enforced policies, compromising centralized access control to remote systems.

The vulnerability scores CVSS 7.5 (high). No public exploit on GitHub has been confirmed. However, social network signals indicate active discussion (13 posts in 24 hours), with mentions of possible active exploitation in unverified posts. The absence of workarounds makes patching mandatory.

SonicWall administrators must upgrade SonicOS to patched versions (Gen7 7.3.4 and later, Gen8 8.2.3 and later, per unverified signals). Verify SAML/MFA configuration on exposed systems. Monitor access logs for connections via alternate authentication methods outside SAML enforcement. No workaround exists: patching is the only defense.