CVE-2026-19868: SonicWall SonicOS SSLVPN MFA Bypass

# CVE-2026-19868: SonicWall SonicOS SSLVPN MFA Bypass

https://gcdradar.vercel.app/incidents/cve-2026-19868-sonicwall-sonicos-sslvpn-mfa-bypass · AIR-2026-1818 · live

- Lane: Patch now
- Severity: 3 (Confirmed exploitation): Exploitation confirmed in the wild and added to CISA KEV.
- Fix status: Patched
- First reported: 2026-11-06
- AI role: No AI role
- Products: SonicOS SSLVPN
- CVE ids: CVE-2026-19868
- CVSS: 7.5

## Summary

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that allows users to bypass SAML authentication and multi-factor controls. The flaw is actively exploited in the wild and has been added to the CISA Known Exploited Vulnerabilities catalog.

## What to do

Apply mitigations in accordance with vendor instructions and CISA guidance.

## Latest updates

- 2026-11-07: Vendor releases patches to address the exploited SSLVPN authentication bypass vulnerability (https://securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins)
- 2026-11-07: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks (https://bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks)
- 2026-11-06: CVE-2026-19868: SonicWall SonicOS SSLVPN — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868)

## Sources

- 2026-11-06 CISA: CVE-2026-19868: SonicWall SonicOS SSLVPN — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2026-19868
- 2026-11-07 BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks https://bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks
- 2026-11-07 SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins https://securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins
- 2026-11-09 The Hacker News: CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation https://thehackernews.com/2026/11/cisa-flags-sonicwall-sonicos-mfa-bypass.html
- 2026-11-09 Help Net Security: Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) https://helpnetsecurity.com/2026/11/09/exploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-2026-19868

Verify against the vendor's advisory before changing production. Data CC BY-SA 4.0, https://gcdradar.vercel.app.