[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fvJy38wXe0u89_W9zWNYWN0czrOBvziRkigNsW26hBLI":3},{"article":4,"iocs":49,"watch_terms":57,"solutions":58,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"36b54889-5afc-41d5-9457-0b052009763c","CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks","cisa-warns-of-sonicwall-sonicos-sslvpn-vulnerability-exploited-in-attacks-95bdcb","CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, warning that valid-credential users can bypass SAML authentication controls and potentially evade multi-factor authentication. CISA added the vulnerability on November 6, 2026, and set a November 20 remediation deadline. Its entry lists ransomware use as unknown and does not require forensic […] The post CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks appeared first on Cyber Security News.","CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, affecting SonicWall SonicOS SSLVPN on Gen7 and Gen8 platforms. The vulnerability allows valid-credential users to bypass SAML authentication controls and potentially evade multi-factor authentication through an alternate authentication method. CISA set a November 20, 2026 remediation deadline, with fixed versions available (7.3.4-7013 for Gen7, 8.2.3-8015 for Gen8).","CISA warns of SonicWall SonicOS SSLVPN authentication bypass (CVE-2026-19868) exploited in attacks.","https:\u002F\u002Fcybersecuritynews.com\u002Fsonicwall-sonicos-sslvpn-vulnerability-exploited\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FCISA-Warns-of-SonicWall-SonicOS-SSLVPN-Vulnerability-Exploited-in-Attacks-.webp","2026-11-09T11:40:18+00:00","2026-11-09T12:01:22.719683+00:00",9,[17,20,23,26],{"name":18,"type":19},"SonicWall","vendor",{"name":21,"type":22},"SonicOS SSLVPN","product",{"name":24,"type":25},"SAML","technology",{"name":27,"type":19},"CISA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,44],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":41,"icon":30,"name":42,"slug":43},"574f766a-fb3f-487c-8d2c-0720ae75471b","Zero-day","zero-day",{"category":45},{"id":46,"icon":30,"name":47,"slug":48},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[50,54],{"type":51,"value":52,"context":53},"cve","CVE-2026-19868","SonicWall SonicOS SSLVPN SAML authentication bypass allowing MFA evasion",{"type":51,"value":55,"context":56},"CVE-2024-53704","Previous SonicWall SSLVPN session hijacking vulnerability (mentioned for context differentiation)",[18,27,21],{"controls":59,"vendors":143},[60,89,118],{"slug":61,"name":62,"problem":63,"products":64},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[65,73,81],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":69,"product_name":70,"url":71,"description":72},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":74,"vendor_name":75,"vendor_logo":76,"product_slug":77,"product_name":78,"url":79,"description":80},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":82,"vendor_name":83,"vendor_logo":84,"product_slug":85,"product_name":86,"url":87,"description":88},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":90,"name":91,"problem":92,"products":93},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[94,102,110],{"vendor_slug":95,"vendor_name":96,"vendor_logo":97,"product_slug":98,"product_name":99,"url":100,"description":101},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":103,"vendor_name":104,"vendor_logo":105,"product_slug":106,"product_name":107,"url":108,"description":109},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"vendor_slug":111,"vendor_name":112,"vendor_logo":113,"product_slug":114,"product_name":115,"url":116,"description":117},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"slug":119,"name":120,"problem":121,"products":122},"patch-management","Automated patch management","Known holes get closed in days, not months.",[123,128,135],{"vendor_slug":66,"vendor_name":67,"vendor_logo":68,"product_slug":124,"product_name":125,"url":126,"description":127},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":129,"vendor_name":130,"vendor_logo":131,"product_slug":119,"product_name":132,"url":133,"description":134},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",[144],{"slug":145,"name":18,"logo_path":146,"roles":147},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"sonicwall-sslvpn-authentication-bypass-exploited-in-the-wild","SonicWall SSLVPN Authentication Bypass Exploited in the Wild","A vulnerability in SonicWall SonicOS (CVE-2026-19868) allows authenticated users to bypass SAML-based authentication controls and circumvent multi-factor authentication, granting attackers elevated or unintended access through an alternate authentication path. This is particularly dangerous because it undermines a core compensating control — MFA — that organizations rely on as a last line of defence against credential compromise. The flaw affects widely deployed Gen7 and Gen8 VPN gateways, making internet-facing perimeter devices an attractive target. Patches have been released, yet CISA's addition to the KEV catalog confirms active exploitation, highlighting the gap between patch availability and patch deployment in many organizations.",[154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","CIS Control 17: Incident Response Management",{"NIS2 Article 21(2)(b)":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"CIS Control 17: Incident Response Management":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 requires essential and important entities to implement incident handling and vulnerability management measures, including timely patching of internet-facing systems like VPN gateways under active exploitation.","SI-2 requires organizations to identify, report, and correct information system flaws within defined timeframes — a process that would have driven timely patching of this SonicOS vulnerability once it was disclosed.","With active exploitation confirmed by CISA, organizations need a practiced incident response process to quickly assess compromise, isolate affected appliances, and recover — capabilities this control directly builds.","The exploited SonicOS versions were outdated relative to the patched releases, embodying exactly the risk OWASP A06 describes when organizations fail to keep third-party components and firmware current.","This control mandates continuous scanning and timely remediation of vulnerabilities; applying it would have ensured the available SonicWall patches were identified and deployed before active exploitation began.","This control requires organizations to obtain timely information about technical vulnerabilities and take appropriate action, directly addressing the need to patch SonicWall devices before exploitation occurred.","This function requires that authentication mechanisms are robust and enforced consistently; had controls been in place to prevent alternate authentication bypass routes, the SAML\u002FMFA circumvention would have been blocked or detected."]