[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fI2WwKGUjvqNwcI7S8KYRwjkTouc54etMqFLqFjYrBcY":3},{"article":4,"iocs":53,"watch_terms":58,"solutions":59,"lesson":148},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":30,"category":31,"article_tags":35},"a0b86818-6b71-4d2b-9462-c17908b5accb","SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins","sonicwall-patches-exploited-sonicos-vulnerability-that-weakens-vpn-logins-829cfb","CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.","SonicWall has released a patch for SonicOS vulnerability CVE-2026-19868, which allows attackers with valid credentials for alternate authentication methods to bypass SAML authentication and potentially SAML-enforced MFA. The vulnerability, rated high severity with a CVSS score of 7.1, has been added to CISA's Known Exploited Vulnerabilities catalog, indicating potential exploitation in the wild. Affected devices include various SonicWall firewall models running older versions of SonicOS.","SonicWall patches SonicOS vulnerability CVE-2026-19868, potentially exploited to bypass SAML VPN authentication.","https:\u002F\u002Fwww.securityweek.com\u002Fsonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins\u002F","https:\u002F\u002Fwww.securityweek.com\u002Fwp-content\u002Fuploads\u002F2025\u002F08\u002FSonicWall.jpg","2026-11-07T10:16:23+00:00","2026-11-07T11:00:04.744772+00:00",8,[17,20,23,26,28],{"name":18,"type":19},"SonicWall","vendor",{"name":21,"type":22},"SonicOS","product",{"name":24,"type":25},"SAML","technology",{"name":27,"type":25},"MFA",{"name":29,"type":22},"SSL VPN","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":30,"icon":32,"name":33,"slug":34},null,"Vulnerabilities","vulnerabilities",[36,41,46,48],{"category":37},{"id":38,"icon":32,"name":39,"slug":40},"26b0b636-0e31-4db1-bffb-61bdf9f20a58","Supply Chain","supply-chain",{"category":42},{"id":43,"icon":32,"name":44,"slug":45},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":47},{"id":30,"icon":32,"name":33,"slug":34},{"category":49},{"id":50,"icon":32,"name":51,"slug":52},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[54],{"type":55,"value":56,"context":57},"cve","CVE-2026-19868","SonicOS SSL VPN authentication bypass vulnerability",[18,21,29],{"controls":60,"vendors":142},[61,90,116],{"slug":62,"name":63,"problem":64,"products":65},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[66,74,82],{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":70,"product_name":71,"url":72,"description":73},"okta","Okta","\u002Fvendor-logos\u002Fokta.png","workforce-identity","Okta Workforce Identity","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fworkforce-identity\u002F","Single sign-on, adaptive MFA including phishing-resistant methods, and lifecycle management for employees.",{"vendor_slug":75,"vendor_name":76,"vendor_logo":77,"product_slug":78,"product_name":79,"url":80,"description":81},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":91,"name":92,"problem":93,"products":94},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[95,103,108],{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":99,"product_name":100,"url":101,"description":102},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"vendor_slug":67,"vendor_name":68,"vendor_logo":69,"product_slug":104,"product_name":105,"url":106,"description":107},"identity-threat-protection","Okta Identity Threat Protection","https:\u002F\u002Fwww.okta.com\u002Fproducts\u002Fidentity-threat-protection\u002F","Continuous risk assessment of sessions after login, with automatic actions such as ending sessions.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-identity-protection","Falcon Identity Protection","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fnext-gen-identity-security\u002Fidentity-protection\u002F","Detection of identity attacks against Active Directory and Entra ID, with risk-based MFA.",{"slug":117,"name":118,"problem":119,"products":120},"patch-management","Automated patch management","Known holes get closed in days, not months.",[121,129,137],{"vendor_slug":122,"vendor_name":123,"vendor_logo":124,"product_slug":125,"product_name":126,"url":127,"description":128},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":130,"vendor_name":131,"vendor_logo":132,"product_slug":133,"product_name":134,"url":135,"description":136},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":96,"vendor_name":97,"vendor_logo":98,"product_slug":138,"product_name":139,"url":140,"description":141},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[143],{"slug":144,"name":18,"logo_path":145,"roles":146},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[147],"affected",{"slug":149,"title":150,"body":151,"framework_refs":152,"framework_notes":160},"sonicwall-authentication-bypass-highlights-patch-urgency-for-vpn-appliances","SonicWall Authentication Bypass Highlights Patch Urgency for VPN Appliances","A high-severity vulnerability in SonicWall's SonicOS allowed attackers with valid credentials for alternate authentication methods to bypass SAML-enforced MFA, effectively neutralizing a critical security control protecting VPN access. The flaw was added to CISA's Known Exploited Vulnerabilities catalog, confirming active exploitation before many organizations had applied the available patch. This incident underscores how perimeter security appliances — often trusted as gatekeepers — can become the weakest link when left unpatched. The bypass of MFA is particularly dangerous because it dismantles a defense-in-depth layer that organizations frequently rely on as a last line of protection against credential-based attacks.",[153,154,155,156,157,158,159],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":161,"PCI DSS Requirement 6":162,"NIST SP 800-53 SI-2: Flaw Remediation":163,"OWASP A06:2021 Vulnerable and Outdated Components":164,"CIS Control 7: Continuous Vulnerability Management":165,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":166,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":167},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices — the confirmed in-the-wild exploitation of this flaw triggers mandatory response obligations under this article.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by applying security patches in a timely manner, which would directly apply to any SonicWall device protecting cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timescales — a formal flaw remediation process would have ensured this KEV-listed patch was applied promptly.","Running an older, unpatched SonicOS version on an internet-facing appliance is a textbook instance of relying on a vulnerable component that introduces exploitable risk to the entire network perimeter.","Regular authenticated scanning of internet-facing appliances would have flagged the unpatched SonicOS version and triggered remediation before active exploitation occurred.","This control mandates timely identification and remediation of technical vulnerabilities in deployed systems, which directly applies to maintaining SonicOS at a patched, non-exploitable version.","The vulnerability directly undermined SAML-enforced MFA; this control area requires that authentication mechanisms are protected, verified, and not bypassable through alternate credential paths."]