[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fWGYCBNdHSsQzTpPC7-CdgTdmBfDiAwfKkG0vkevbKJ0":3},{"article":4,"iocs":55,"watch_terms":63,"solutions":64,"lesson":152},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6f2936f7-949b-4491-82fe-ab9485b1defe","SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks","sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks-3851f1","SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks. [...]","SonicWall has released updates to fix seven vulnerabilities in its SonicOS firewalls, including CVE-2026-19868, an SSL-VPN authentication bypass flaw that allows attackers to bypass SAML-enforced MFA. The vulnerability, rated CVSS 7.1, has been confirmed by CISA as exploited in the wild and added to its KEV catalog, with federal agencies ordered to patch by November 20, 2026. Six other vulnerabilities, including two critical management interface flaws, were also addressed.","SonicWall warns of SSL-VPN MFA bypass flaw (CVE-2026-19868) exploited in attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fsonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2025\u002F05\u002F08\u002FSonicWall.jpg","2026-11-07T00:00:55+00:00","2026-11-07T01:00:30.594545+00:00",9,[17,20,22,25,28,30],{"name":18,"type":19},"SonicOS","product",{"name":21,"type":19},"SMA1000",{"name":23,"type":24},"SonicWall","vendor",{"name":26,"type":27},"SSL-VPN","technology",{"name":29,"type":27},"SAML",{"name":31,"type":27},"MFA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60],{"type":57,"value":58,"context":59},"cve","CVE-2026-19868","SSL-VPN authentication bypass flaw allowing SAML MFA bypass.",{"type":57,"value":61,"context":62},"CVE-2026-102255","Maximum severity vulnerability in SonicWall SMA1000 appliances.",[23,18,21],{"controls":65,"vendors":146},[66,95,121],{"slug":67,"name":68,"problem":69,"products":70},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[71,79,87],{"vendor_slug":72,"vendor_name":73,"vendor_logo":74,"product_slug":75,"product_name":76,"url":77,"description":78},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":80,"vendor_name":81,"vendor_logo":82,"product_slug":83,"product_name":84,"url":85,"description":86},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":91,"product_name":92,"url":93,"description":94},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"slug":96,"name":97,"problem":98,"products":99},"identity-threat-detection","Identity threat detection and response (ITDR)","Attackers who log in with real, stolen credentials get noticed.",[100,108,116],{"vendor_slug":101,"vendor_name":102,"vendor_logo":103,"product_slug":104,"product_name":105,"url":106,"description":107},"huntress","Huntress","\u002Fvendor-logos\u002Fhuntress.png","managed-itdr","Huntress Managed ITDR","https:\u002F\u002Fwww.huntress.com\u002Fplatform\u002Fmanaged-itdr","Managed detection of suspicious activity in Microsoft 365 and Entra ID.",{"vendor_slug":109,"vendor_name":110,"vendor_logo":111,"product_slug":112,"product_name":113,"url":114,"description":115},"vectra-ai","Vectra AI","\u002Fvendor-logos\u002Fvectra-ai.png","vectra-ai-platform","Vectra AI Platform","https:\u002F\u002Fwww.vectra.ai\u002Fplatform","Detection of attacker behaviour across network, identity and cloud.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":117,"product_name":118,"url":119,"description":120},"defender-for-identity","Microsoft Defender for Identity","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fsiem-and-xdr\u002Fmicrosoft-defender-for-identity","Detects attacks against on-premises Active Directory and hybrid identities.",{"slug":122,"name":123,"problem":124,"products":125},"patch-management","Automated patch management","Known holes get closed in days, not months.",[126,133,138],{"vendor_slug":127,"vendor_name":128,"vendor_logo":129,"product_slug":122,"product_name":130,"url":131,"description":132},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":88,"vendor_name":89,"vendor_logo":90,"product_slug":134,"product_name":135,"url":136,"description":137},"intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"vendor_slug":139,"vendor_name":140,"vendor_logo":141,"product_slug":142,"product_name":143,"url":144,"description":145},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",[147],{"slug":148,"name":23,"logo_path":149,"roles":150},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[151],"affected",{"slug":153,"title":154,"body":155,"framework_refs":156,"framework_notes":164},"sonicwall-ssl-vpn-mfa-bypass-exploited-in-the-wild","SonicWall SSL-VPN MFA Bypass Exploited in the Wild","A critical authentication bypass vulnerability (CVE-2026-19868) in SonicWall's SonicOS allowed attackers to circumvent SAML-enforced multi-factor authentication on SSL-VPN connections, effectively rendering a key security control useless. The flaw was confirmed as actively exploited before many organizations had time to patch, highlighting the narrow window between disclosure and weaponization for perimeter security appliances. This matters because SSL-VPN gateways are trusted entry points into corporate networks, and bypassing MFA at this layer can grant attackers broad internal access with minimal friction. Organizations relying on MFA as a sole compensating control for remote access were left exposed, underscoring that MFA is only as strong as the platform implementing it.",[157,158,159,160,161,162,163],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":165,"PCI DSS Requirement 6":166,"NIST SP 800-53 SI-2: Flaw Remediation":167,"OWASP A06:2021 Vulnerable and Outdated Components":168,"CIS Control 7: Continuous Vulnerability Management":169,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":170,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":171},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices, including patching critical network security components within defined windows to maintain operational resilience.","PCI DSS Requirement 6 mandates that organizations develop and maintain secure systems by protecting them from known vulnerabilities, requiring timely patching of network security appliances like VPN gateways that handle cardholder data environments.","SI-2 requires organizations to identify, report, and correct information system flaws on defined timelines, directly addressing the need for rapid patching of the SonicWall authentication bypass vulnerability.","Running unpatched SonicOS firmware with a known authentication bypass vulnerability is a textbook instance of using vulnerable components that expose the entire network perimeter to attack.","Regular, prioritized vulnerability scanning and patching cycles for internet-facing appliances would have flagged CVE-2026-19868 and driven remediation before attackers exploited it in the wild.","This control requires timely identification and remediation of technical vulnerabilities in information systems, which would have mandated a rapid patch response to this actively exploited SonicOS flaw.","The PR.AA function requires that authentication mechanisms are properly implemented and protected; a flaw allowing MFA bypass at the VPN layer is a direct failure of this control domain."]