SonicWall SonicOS SSLVPN flaw exploited to bypass SAML and MFA via CVE-2026-19868
TL;DR
SonicWall's SonicOS SSLVPN service is vulnerable to CVE-2026-19868, which allows attackers to bypass SAML and multi-factor authentication. CISA added this flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026, following evidence of active exploitation. Update your firmware immediately.
What happened
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026. The vulnerability is an authentication enforcement flaw within the SonicWall SonicOS SSLVPN service.
If exploited, the flaw allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. This bypass can also circumvent SAML-enforced multi-factor authentication (MFA). The vulnerability carries a CVSS score of 7.5.
Why it matters
This is a critical failure in identity enforcement. For organizations relying on SonicWall SSLVPNs for remote access, the security of your MFA and SAML controls is compromised. An attacker with secondary credentials can essentially walk past your primary identity provider and multi-factor requirements. Because CISA has confirmed active exploitation, the risk is no longer theoretical. If you use SonicOS for VPN access, your perimeter is currently being tested.
Who is affected
- SonicWall SonicOS (specific versions not disclosed)
What to do now
- Apply the latest SonicWall firmware updates to address the SSLVPN authentication bypass.
- Audit SSLVPN access logs for unauthorized authentication attempts or successful bypasses.
- Verify that SAML and MFA controls are functioning correctly on all SonicOS instances.
What we don't know yet
- The specific versions of SonicOS that are vulnerable.
- The availability of a specific patch or fixed version string.
- The full scope of the active exploitation campaign.
Sources
