Threat watch / Vulnerability
SonicWall SSLVPN: a flaw lets other credentials skip SAML and its MFA
SonicWall says a SonicOS SSLVPN flaw, CVE-2026-19868, can let a user with valid credentials for another authentication method bypass SAML login controls, including SAML-enforced MFA. It investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalog.
- Sector
- Many sectors
- Way in
- Software flaw
- Product or vendor
- SonicWall SonicOS
- How it happened
- SonicWall's advisory, as quoted by SecurityAffairs: an authentication enforcement flaw in the SSLVPN service "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls", which may also bypass SAML-enforced MFA. The attacker needs valid credentials; it only matters where SAML is enabled for SSLVPN logins.[2][1] Checked 8 Nov 2026
- What was stolen
- Not public yet Checked 8 Nov 2026
- Who was impacted
- Not public yet Checked 8 Nov 2026
- Threat actor
- Not attributed
- CVE
- CVE-2026-19868
Timeline
- SonicWall publishes its advisory. It says it investigated a report indicating potential exploitation and urges customers to upgrade. Affected: Gen7 hardware and NSv on SonicOS 7.3.3-7015 or earlier, Gen8 on 8.2.2-8015 or earlier; fixed in 7.3.4-7013 and 8.2.3-8015 or later, according to CyberSecurityNews. [1][2]
- SecurityAffairs reports that CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, with a November 20, 2026 deadline for U.S. federal agencies. No victim has been named. [2]