The SonicWall SAML MFA bypass (CVE-2026-19868), actively exploited per CISA on November 6, is straightforward: attackers with valid credentials in an alternate authentication method can bypass SAML-enforced MFA on SSL-VPN endpoints. CVSS score 7.1.
What’s interesting is what this reveals about deployment patterns. The flaw doesn’t require technical sophistication. It requires what many organizations already have: users with credentials in multiple auth systems. A legitimate LDAP account becomes a bypass route if both systems are configured as fallback options on the same endpoint.
This is a credential-to-bypass pipeline. Sophistication lives in reconnaissance: finding which alternate credentials work, or acquiring them through phishing or prior breach. SonicWall’s advisory recommends disabling non-SAML authentication entirely. The vulnerability surfaces misconfigurations that were already risky.
Patches are available for SonicOS Gen7 (7.3.4-7013 and later) and Gen8 (8.2.3-8015 and later). Multi-method auth on a single endpoint sounds solid; in practice, it’s a lateral move waiting to be found.
Sources: CISA Known Exploited Vulnerabilities Catalog • SonicWall Security Advisory SNWLID-2026-0014
Coverage: BleepingComputer
Related on this blog: [AUTO] Fire Ant Expands to Router and Authentication Infrastructure • FortiBleed Ran on a Command Fortinet Ships in the Box • [AUTO] Why Langflow’s Authenticated RCE Matters