Cybersecurity firm SonicWall has rolled out critical security patches to address an actively exploited vulnerability in its SonicOS software. The flaw, tracked as CVE-2026-19868, compromises the integrity of virtual private network (VPN) authentication mechanisms by potentially allowing malicious actors with valid credentials for an alternate login method to bypass standard Security Assertion Markup Language (SAML) checks.
According to security advisories, the security gap specifically impacts SAML-enforced multi-factor authentication (MFA) protocols. By evading these rigorous verification controls, attackers who have acquired low-tier or secondary login credentials could gain unauthorized access to protected network perimeters.
The discovery of the vulnerability in the wild underscores the persistent targeting of enterprise edge devices and VPN gateways by sophisticated threat groups. Administrators managing affected SonicWall infrastructure are strongly urged to apply the latest firmware updates immediately to mitigate potential exploitation risks.