SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA

A critical flaw in SonicWall's SonicOS SSLVPN (CVE-2026-19868) allows attackers with valid credentials for any alternate authentication method to bypass SAML-based MFA entirely, undermining a key security control organizations rely on. This matters because MFA is widely treated as a near-impenetrable last line of defence, and a bypass at the network perimeter exposes the entire internal environment to unauthorized access. Edge devices like VPN gateways are high-value targets precisely because they face the internet and authenticate remote users, making unpatched vulnerabilities on them exceptionally dangerous. The fact that active exploitation is already suspected underscores how quickly threat actors operationalize flaws in widely deployed security appliances, leaving organizations with very little reaction time.