SonicWall releases security updates to address CVE-2026-19868, an authentication bypass flaw affecting SonicOS SSL-VPN configurations using SAML. The reported issue can allow an attacker who has valid credentials for a different supported authentication method to get past SAML checks, including cases where SAML-enforced MFA is required.
The available coverage describes a scenario in which an external attacker with network access to the SSL VPN, and credentials for an alternative login method, leverages the weakness to bypass the normal SAML authentication path. While sources note SonicWall is investigating exploitation reports, publicly available details do not spell out the exact post-login actions or provide specific indicators of compromise.
Across outlets, the focus is on the same core mechanism—credentials for one authentication method weakening SAML enforcement—and the same affected environment (SonicOS Gen7/Gen8 SSL VPN with SAML). The main differences are how each outlet emphasizes the exploitation context (some foreground “exploited in attacks”) and how they frame the breadth of SonicOS fixes in a single update cycle.
