CVE-2026-19868
SonicOS SSL-VPN flaw lets attackers bypass SAML and MFA
The flaw is in the SonicWall SonicOS SSLVPN service and lets a user with valid credentials for another authentication method bypass SAML authentication controls, including SAML-enforced multi-factor authentication. It affects SonicOS firewalls using SSL-VPN. CISA has added it to its known exploited list, meaning attackers are using it, and SonicWall has released security updates to fix it, though no fixed version numbers are given in these records.
SonicWall SonicOS · Updated 7 Nov · From 1 of our story and the public records
Being exploitedYesAttackers are using it
CISA known exploitedListedAdded 6 Nov; US agencies must fix by 20 Nov
SeverityhighCVSS 7.5 of 10
FixNot yetSee what to do below
Am I affected?
The records do not list fixed versions yet. Check the vendor's advisory below.
What to do
- Apply SonicWall's security updates for SonicOS immediately, since the records do not list specific fixed versions.
- Treat SSL-VPN access as at risk until patched and review logs for unusual authentication activity.
- Follow CISA's required remediation deadline of 2026-11-20 for US federal agencies.
What happened
- 6 NovCISA added the vulnerability to its known exploited catalog and required US federal agencies to fix it by 2026-11-20.
- 7 NovSonicWall warned of reported exploitation and released security updates for seven SonicOS vulnerabilities.
- 7 NovBleepingComputer reported on SonicWall's warning about the SSL-VPN MFA bypass flaw being exploited in attacks.
The record
| CVE | What it is | Severity | CISA listed | Exploit chance, 30 days |
|---|---|---|---|---|
| CVE-2026-19868 | SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability | high 7.5 | 6 Nov | — |
Our reporting
7 NovSonicWall warns of reported exploitation of SSL-VPN MFA bypass flawReported elsewhere
BleepingComputer · 7 NovSonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks ↗CISA · 6 NovCISA Adds One Known Exploited Vulnerability to Catalog ↗The records
psirt.global.sonicwall.com: advisory ↗CISA known-exploited catalog ↗CVE-2026-19868 on NVD ↗Is anything you run affected?Connect Zotpaper to Claude, ChatGPT or Cursor and ask. It checks your project's packages against this vulnerability and every other one in the advisory databases, and says what to update. Your first 20 lookups are free.
Try it free