SonicWall pushed out fixes for a firewall flaw that lets an attacker with credentials for any alternate login method walk straight past SAML, and with it the multi-factor authentication most hospitals bolted onto remote access.
CISA added the bug to its known exploited vulnerabilities catalog, confirming use in the wild, and gave federal civilian agencies until November 20 to patch. SonicWall said its product security team investigated a report of exploitation and urged customers to upgrade immediately. It published no details of who was attacked.
The flaw behind the MFA bypass
Tracked as CVE-2026-19868, it carries a 7.1 score and bites only where SonicOS SSL-VPN is set up for SAML. Hold a valid credential on some other authentication path and the SAML checks on that connection can be stepped around. The Electronic Office’s Ryan Harris is credited with the find.
Six further flaws came in the same advisory, including two management interface bugs rated 8.8 that let unauthenticated attackers perform unauthorized operations under specific conditions, plus pre-authentication buffer overflows and weak password hashing on virtual appliances. On the fixed side are 7.3.4-7013 and 8.2.3-8015, covering Gen7 7.3.3-7015 and Gen8 8.2.2-8015 and anything older. SonicWall listed no workarounds.
This is the fourth SonicWall problem to draw exploitation reporting since July, after SMA1000 zero-days in July and September and a maximum-severity flaw in October.
For health systems the pattern matters more than the score. VPN concentrators are how clinicians reach the record from home, and they are the one internet-facing device a hospital cannot simply switch off. Enumerate every SonicOS instance terminating a SAML-backed remote path, patch it, then read authentication logs from the bypass window rather than assuming a clean patch closes the question.
