SonicWall's SAML VPN Bypass: The Questions MSPs Need to Answer

A ticket that says “SonicWall patched” leaves out the question at the center of CVE-2026-19868: which sign-in routes would the SSL VPN accept, and did they all enforce the intended controls? For an MSP with several client firewalls, that question needs an answer for each deployment, not just a firmware job marked complete.SonicWall published its SonicOS advisory on November 6. The Canadian Centre for Cyber Security says SonicWall has observed exploitation, and CISA added the CVE to its Known Exploited Vulnerabilities catalog. That calls for an expedited review. It does not establish that every SonicWall firewall, or every client using one, has been compromised.The credential condition mattersThe published CVE description says a person with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls in the SonicOS SSL VPN service. If MFA is enforced through that SAML route, successful exploitation may bypass that MFA requirement too. The…

Commenting on Bubbles has been removed. Why? If you want to talk about this post, write to the author, use the comments on their blog if it has them, or reply with a "RE:" post on your own blog. Suggestions? feedback@bubbles.town