SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall warns of SSL-VPN MFA bypass flaw (CVE-2026-19868) exploited in attacks.
Run SonicWall?
Get an email when a reviewed story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
SonicWall has released updates to fix seven vulnerabilities in its SonicOS firewalls, including CVE-2026-19868, an SSL-VPN authentication bypass flaw that allows attackers to bypass SAML-enforced MFA. The vulnerability, rated CVSS 7.1, has been confirmed by CISA as exploited in the wild and added to its KEV catalog, with federal agencies ordered to patch by November 20, 2026. Six other vulnerabilities, including two critical management interface flaws, were also addressed.
The lesson from this incident
Full lessonA critical authentication bypass vulnerability (CVE-2026-19868) in SonicWall's SonicOS allowed attackers to circumvent SAML-enforced multi-factor authentication on SSL-VPN connections, effectively rendering a key security control useless. The flaw was confirmed as actively exploited before many organizations had time to patch, highlighting the narrow window between disclosure and weaponization for perimeter security appliances. This matters because SSL-VPN gateways are trusted entry points into corporate networks, and bypassing MFA at this layer can grant attackers broad internal access with minimal friction. Organizations relying on MFA as a sole compensating control for remote access were left exposed, underscoring that MFA is only as strong as the platform implementing it.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
- cve — CVE-2026-19868
- cve — CVE-2026-102255