SonicWall SSL-VPN MFA bypass vulnerability exploited in attacks

SonicWall released security updates fixing seven SonicOS vulnerabilities. One of them, CVE-2026-19868, allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). SonicWall reported investigating potential exploitation in an attack, and CISA added the vulnerability to its Known Exploited Vulnerabilities catalog.