SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
80
CVE-2026-19868
SAML bypass in SonicWall SonicOS SSLVPN
CISA: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- CVSS 3.1
- 7.5 high
- EPSS
- <1%p50
- Published
- ·
- Added to KEV
AI analysisSummaries by Vani AI
SonicWall SonicOS SSLVPN has an authentication enforcement vulnerability. A user with valid credentials for an alternate authentication method can bypass SAML controls. This may also bypass SAML-enforced MFA. An attacker with valid credentials can trigger the bypass via the SSLVPN service and gain unauthorized access. Affected are users of SonicWall SonicOS SSLVPN.
What to do: Apply SonicWall's update for CVE-2026-19868. No workaround provided.
| Product | Affected |
|---|---|
| SonicWall SonicOS SSLVPN | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
KEVCISA Known Exploited Vulnerability
- Affected
- SonicWall SonicOS SSLVPN
- Required action
- Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
- Due date
- Ransomware use
- Unknown
- Weakness
- CWE-308
- Vector
- CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
In the news
13 storiesExploited SonicWall SSL-VPN flaw bypasses SAML-enforced MFA
Attackers with valid alternate credentials can skip SAML MFA; federal agencies must remediate by November 20, 2026.
78
SonicWall SSL-VPN vulnerability bypasses SAML and MFA
SonicWall SSL-VPN auth bypass CVE-2026-19868 affects Gen7 and Gen8 SonicOS, fixed in 7.3.4-7013 and 8.2.3-8015.
75
SonicWall SonicOS prior to 7.3.4-7013 and 8.2.2-8015 affected by exploited CVE-2026-19868
CISA added CVE-2026-19868 to KEV Catalog on November 6, 2026; SonicWall SonicOS versions prior to 7.3.4-7013 and 8.2.2-8015 are being exploited.
75
CISA adds CVE-2026-19868 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-19868, affecting SonicWall SonicOS, to its KEV Catalog due to active exploitation.
75
SonicWall SSL-VPN flaw CVE-2026-19868 can bypass SAML MFA
SonicWall calls exploitation only potential; Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 need firmware, with no workaround.
74
CISA adds SonicWall SonicOS MFA bypass to KEV catalog
CISA urges FCEB agencies to patch by November 20, 2026; possible exploitation reported
70
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
SonicWall patches CVE-2026-19868 that bypasses SAML and MFA in SSL VPN after exploitation; CISA added it to KEV with federal deadline November 20.
70
SonicWall SonicOS SSLVPN SAML bypass vulnerability (CVE-2026-19868)
SonicWall SonicOS SSLVPN allows users with valid credentials to bypass SAML authentication and multi-factor controls.
70
Threat bulletin covers library ransomware and exploited SonicWall, OpenSSH flawsNew
SonicOS SAML VPN bypass and OpenSSH before 10.6p2 are described as actively exploited; Android 14–17 RCE is also patched.
66
SonicWall warns of SSLVPN flaw bypassing MFA
CVE-2026-19868 in SonicOS SSLVPN allows credentialed attackers to bypass SAML and MFA when enabled; fix available in versions 7.3.4-7013 and 8.2.3-8015.
65
CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks
CISA added a SonicWall SonicOS SSLVPN vulnerability to its Known Exploited Vulnerabilities catalog, warning of bypasses of SAML and MFA.
60
CISA adds SonicWall SSLVPN flaw to KEV catalog
CISA adds CVE-2026-19868 authentication bypass to KEV catalog.
50