Skip to content
NewA calmer, faster ZeroHour
Exploit / PoChigh

SonicWall SonicOS SSLVPN SAML bypass vulnerability (CVE-2026-19868)

Original title: CISA KEV: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability — SonicWall SonicOS SSLVPN (CVE-2026-19868)

CISA Known Exploited Vulnerabilities ()1 min read1
Read at cisa.gov
Part of a story covered by 10 sourcesCISA Adds SonicWall SSLVPN MFA Bypass Flaw to KEVMerged summary & timeline
AI summary · x-ai/grok-4.7Summaries by Vani AI

SonicWall SonicOS SSLVPN allows users with valid credentials to bypass SAML authentication and multi-factor controls.

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication. Required action: Apply mitigations in accordance with vendor instructions and CISA’s BOD 26-04 by November 20, 2026.

Unconfirmed: Unknown whether the vulnerability is used in known ransomware campaigns.

Key facts
  • Vulnerability may bypass SAML-enforced multi-factor authentication.
  • Apply mitigations per vendor instructions.
  • Ensure compliance with CISA BOD 26-04.
  • Evaluate each asset's internet exposure.
Security assessment · AI, from the article

Impact: Bypass of SAML authentication controls and multi-factor authentication

What to do
  1. 1.Apply mitigations in accordance with vendor instructions
  2. 2.Ensure compliance with CISA BOD 26-04
  3. 3.Evaluate internet exposure and adhere to patching guidelines
Analyze CVE-2026-19868 with Vani AIImpact, affected versions, exploitation, mitigations and detection
CVEs
CVE-2026-19868
Tags
sonicwallsslvpnsamlmfacisakev
Vendors
SonicWall
Products
SonicOS SSLVPN
Organizations
CISA

Vulnerabilities mentioned

All
CVEVulnerabilityCVSSEPSSSignalsPublished
CVE-2026-19868
SAML bypass in SonicWall SonicOS SSLVPN
7.5<1%KEVPoC
KEV

From the original article

1 min read at cisa.gov

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

CISA Known Exploited Vulnerabilities

cisa.gov

Read the full article at CISA Known Exploited Vulnerabilities

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.