Vulnerabilities · 2h ago
BleepingComputer reports attackers exploiting one of seven SonicWall SonicOS flaws, CVE-2026-19868, to bypass authentication on SSL-VPN. SonicWall says the flaw affects SSL-VPN only when Security Assertion Markup Language (SAML) is enabled for logins.
A user with valid credentials through another authentication method can enter without passing SAML’s sign-in checks; where SAML enforces multifactor authentication (MFA), that route can bypass MFA too. The advisory’s other six flaws have separate conditions and impacts, so this exploitation report concerns the authentication flaw, not the entire set.
For SonicWall deployments using SSL-VPN, SAML, and alternate login methods, the report puts the expected SAML/MFA gate in doubt for that access path. It does not identify affected customers or establish which accounts, if any, attackers reached, leaving the scope of any resulting exposure unclear.
Published Nov 6 by SonicWall
Known exploited · CISA KEV
CVSS 7.5 HIGH: an authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls.
CISA federal remediation date Nov 20
3 sources covering this story
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
Part of the PlainSec briefing for 2026-11-07