[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fptlRkET0llhfD6yRc1WKxxDqWpu3kfW9FKN3zCHRxQY":3},{"article":4,"iocs":50,"watch_terms":55,"solutions":56,"lesson":149},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"55554188-ce34-41e9-bbae-44deb33b770b","Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)","exploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-202-81dd95","SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins. According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass … More → The post Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) appeared first on Help Net Security.","SonicWall has released a patch for CVE-2026-19868, a vulnerability in its SonicOS SSL-VPN service that allows attackers with valid credentials to bypass SAML-enforced multi-factor authentication. This means stolen credentials could be used to log in with just a password, circumventing MFA checks. The vulnerability affects specific Gen7 and Gen8 firewall appliances, and CISA has added it to its Known Exploited Vulnerabilities catalog, requiring US federal agencies to patch by November 20, 2026.","SonicWall SSL-VPN flaw (CVE-2026-19868) allows SAML MFA bypass with valid credentials.","https:\u002F\u002Fwww.helpnetsecurity.com\u002F2026\u002F11\u002F09\u002Fexploited-sonicwall-ssl-vpn-flaw-lets-attackers-bypass-saml-enforced-mfa-cve-2026-19868\u002F","https:\u002F\u002Fimg.helpnetsecurity.com\u002Fwp-content\u002Fuploads\u002F2024\u002F08\u002F26192636\u002Fsonicwall-2.webp","2026-11-09T10:30:25+00:00","2026-11-09T11:00:18.342076+00:00",9,[17,20,23,26,28,30],{"name":18,"type":19},"SonicOS SSL-VPN","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":25},"SAML","technology",{"name":27,"type":25},"MFA",{"name":29,"type":19},"Microsoft Entra ID",{"name":31,"type":19},"Okta","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,45],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":32,"icon":34,"name":35,"slug":36},{"category":46},{"id":47,"icon":34,"name":48,"slug":49},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[51],{"type":52,"value":53,"context":54},"cve","CVE-2026-19868","SonicWall SSL-VPN authentication bypass vulnerability",[21,18,29],{"controls":57,"vendors":143},[58,86,115],{"slug":59,"name":60,"problem":61,"products":62},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[63,71,78],{"vendor_slug":64,"vendor_name":65,"vendor_logo":66,"product_slug":67,"product_name":68,"url":69,"description":70},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":72,"vendor_name":31,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":79,"vendor_name":80,"vendor_logo":81,"product_slug":82,"product_name":83,"url":84,"description":85},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":87,"name":88,"problem":89,"products":90},"privileged-access-management","Privileged access management (PAM)","Admin accounts stop being one stolen password away from control of everything.",[91,99,107],{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"delinea","Delinea","\u002Fvendor-logos\u002Fdelinea.png","secret-server","Delinea Secret Server","https:\u002F\u002Fdelinea.com\u002Fproducts\u002Fsecret-server","Vault for privileged credentials with discovery, rotation and session recording.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"beyondtrust","BeyondTrust","\u002Fvendor-logos\u002Fbeyondtrust.png","password-safe","BeyondTrust Password Safe","https:\u002F\u002Fwww.beyondtrust.com\u002Fproducts\u002Fpassword-safe","Privileged password and session management.",{"vendor_slug":108,"vendor_name":109,"vendor_logo":110,"product_slug":111,"product_name":112,"url":113,"description":114},"wallix","WALLIX","\u002Fvendor-logos\u002Fwallix.png","wallix-pam","WALLIX PAM","https:\u002F\u002Fwww.wallix.com\u002Fproducts\u002Fprivileged-access-management-software\u002F","Privileged access management with session recording, for IT and OT environments.",{"slug":116,"name":117,"problem":118,"products":119},"patch-management","Automated patch management","Known holes get closed in days, not months.",[120,127,135],{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":116,"product_name":124,"url":125,"description":126},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":139,"product_name":140,"url":141,"description":142},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",[144],{"slug":145,"name":21,"logo_path":146,"roles":147},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[148],"affected",{"slug":150,"title":151,"body":152,"framework_refs":153,"framework_notes":161},"sonicwall-mfa-bypass-flaw-exploited-in-the-wild","SonicWall MFA Bypass Flaw Exploited in the Wild","CVE-2026-19868 exposes a critical flaw in SonicWall's SSL-VPN implementation where attackers holding valid but stolen credentials can completely bypass SAML-enforced multi-factor authentication, reducing MFA to a false sense of security. This matters because MFA is widely regarded as one of the most effective controls against credential-based attacks — when it can be bypassed at the authentication layer itself, an entire tier of defence collapses. The vulnerability affects Gen7 and Gen8 firewall appliances and is already being actively exploited, meaning organisations that have not patched are exposed right now. CISA's inclusion in the Known Exploited Vulnerabilities (KEV) catalogue underscores the urgency, as real-world threat actors are leveraging this gap. Delayed patching of internet-facing network appliances like VPN gateways is especially dangerous because they sit at the perimeter and authenticate every remote user.",[154,155,156,157,158,159,160],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","NIS2 Article 21(2)(b)","OWASP A06:2021 Vulnerable and Outdated Components","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":162,"PCI DSS Requirement 6":163,"NIST SP 800-53 SI-2: Flaw Remediation":164,"OWASP A06:2021 Vulnerable and Outdated Components":165,"CIS Control 7: Continuous Vulnerability Management":166,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":167,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":168},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including rapid patching of actively exploited flaws in critical network infrastructure like VPN gateways.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through patching and secure development, which would obligate rapid remediation of an actively exploited VPN authentication flaw.","SI-2 requires organisations to identify, report, and correct information system flaws on defined timelines — formal flaw remediation procedures would have driven urgent patching of this perimeter device.","The SonicWall appliance running unpatched firmware is precisely the scenario A06 addresses — using components with known vulnerabilities that expose the entire authentication stack to compromise.","Regular, prioritised scanning of internet-facing appliances would have flagged CVE-2026-19868 immediately after disclosure, enabling patching before active exploitation began.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in information systems, directly requiring the kind of patch-response process that would have closed this flaw before exploitation.","PR.AA calls for robust, enforced authentication mechanisms; had additional compensating controls (e.g., device trust, conditional access) been layered around the VPN, the SAML bypass alone would not have granted full access."]