[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fzSQM0bHTVjqlVORsyaFFF-h_frvCiLJBFefO-qOJVLk":3},{"article":4,"iocs":46,"watch_terms":67,"solutions":68,"lesson":159},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":28,"category":29,"article_tags":33},"55cd383c-0273-4977-8c1a-c8147ff5f433","SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA","sonicwall-warns-of-potential-in-the-wild-exploitation-of-sslvpn-flaw-that-bypass-f6860c","SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks. Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1. The company has investigated a report indicating potential exploitation and strongly urges customers to upgrade promptly. The issue affects SSLVPN only when […] The post SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA appeared first on Cyber Security News.","SonicWall has alerted customers to a critical vulnerability (CVE-2026-19868) in its SonicOS SSLVPN that allows attackers to bypass SAML and multi-factor authentication. The flaw, with a CVSS score of 7.1, requires an attacker to possess valid credentials for an alternate authentication method. SonicWall is investigating reports of potential exploitation and urges immediate patching, as successful exploitation could leave systems vulnerable despite expected security policies.","SonicWall warns of potential in-the-wild exploitation of a SonicOS SSLVPN flaw bypassing MFA.","https:\u002F\u002Fcybersecuritynews.com\u002Fsonicos-sslvpn-vulnerability-exploited\u002F","https:\u002F\u002Fcybersecuritynews.com\u002Fwp-content\u002Fuploads\u002F2026\u002F11\u002FSonicOS-SSLVPN-Vulnerability-Exploited.webp","2026-11-07T12:59:02+00:00","2026-11-07T13:00:36.609854+00:00",8,[17,20,23,26],{"name":18,"type":19},"SonicOS SSLVPN","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":25},"SAML","technology",{"name":27,"type":25},"MFA","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":28,"icon":30,"name":31,"slug":32},null,"Vulnerabilities","vulnerabilities",[34,39,41],{"category":35},{"id":36,"icon":30,"name":37,"slug":38},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":40},{"id":28,"icon":30,"name":31,"slug":32},{"category":42},{"id":43,"icon":30,"name":44,"slug":45},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[47,51,54,56,59,62,64],{"type":48,"value":49,"context":50},"cve","CVE-2026-19868","SonicOS SSLVPN vulnerability allowing MFA bypass",{"type":48,"value":52,"context":53},"CVE-2026-107155","SonicOS management interface vulnerability",{"type":48,"value":55,"context":53},"CVE-2026-107154",{"type":48,"value":57,"context":58},"CVE-2026-82308","SonicOS SSLVPN pre-authentication heap buffer overflow",{"type":48,"value":60,"context":61},"CVE-2026-77708","SonicOS TACACS+ authentication client vulnerability",{"type":48,"value":63,"context":61},"CVE-2026-77709",{"type":48,"value":65,"context":66},"CVE-2026-19703","SonicOS virtual appliance credential exposure vulnerability",[21,18],{"controls":69,"vendors":153},[70,99,128],{"slug":71,"name":72,"problem":73,"products":74},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[75,83,91],{"vendor_slug":76,"vendor_name":77,"vendor_logo":78,"product_slug":79,"product_name":80,"url":81,"description":82},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"slug":100,"name":101,"problem":102,"products":103},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[104,112,120],{"vendor_slug":105,"vendor_name":106,"vendor_logo":107,"product_slug":108,"product_name":109,"url":110,"description":111},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":116,"product_name":117,"url":118,"description":119},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":121,"vendor_name":122,"vendor_logo":123,"product_slug":124,"product_name":125,"url":126,"description":127},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"slug":129,"name":130,"problem":131,"products":132},"patch-management","Automated patch management","Known holes get closed in days, not months.",[133,141,149],{"vendor_slug":134,"vendor_name":135,"vendor_logo":136,"product_slug":137,"product_name":138,"url":139,"description":140},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":142,"vendor_name":143,"vendor_logo":144,"product_slug":145,"product_name":146,"url":147,"description":148},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":113,"vendor_name":114,"vendor_logo":115,"product_slug":129,"product_name":150,"url":151,"description":152},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",[154],{"slug":155,"name":21,"logo_path":156,"roles":157},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[158],"affected",{"slug":160,"title":161,"body":162,"framework_refs":163,"framework_notes":171},"sonicwall-sslvpn-mfa-bypass-highlights-urgency-of-timely-patching-on-edge-devices","SonicWall SSLVPN MFA Bypass Highlights Urgency of Timely Patching on Edge Devices","A critical flaw in SonicWall's SonicOS SSLVPN (CVE-2026-19868) allows attackers with valid credentials for any alternate authentication method to bypass SAML-based MFA entirely, undermining a key security control organizations rely on. This matters because MFA is widely treated as a near-impenetrable last line of defence, and a bypass at the network perimeter exposes the entire internal environment to unauthorized access. Edge devices like VPN gateways are high-value targets precisely because they face the internet and authenticate remote users, making unpatched vulnerabilities on them exceptionally dangerous. The fact that active exploitation is already suspected underscores how quickly threat actors operationalize flaws in widely deployed security appliances, leaving organizations with very little reaction time.",[164,165,166,167,168,169,170],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","MITRE ATT&CK T1566: Phishing",{"NIS2 Article 21(2)(b)":172,"MITRE ATT&CK T1566: Phishing":173,"NIST SP 800-53 SI-2: Flaw Remediation":174,"OWASP A06:2021 Vulnerable and Outdated Components":175,"CIS Control 7: Continuous Vulnerability Management":176,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":177,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":178},"NIS2 requires essential and important entities to implement incident handling and vulnerability management practices; the in-the-wild exploitation of this VPN flaw makes timely patching a direct compliance obligation for affected organizations under NIS2.","While the primary vector here is credential abuse plus MFA bypass rather than phishing, attackers frequently combine phishing to harvest the valid credentials required to exploit this flaw, making phishing-resistant authentication and credential hygiene critical companion controls.","SI-2 requires organizations to identify, report, and correct information system flaws on a defined schedule; a formal flaw remediation process for perimeter appliances would have driven urgent action on this SonicWall advisory.","The SSLVPN appliance running an unpatched SonicOS version is precisely the kind of vulnerable component OWASP A06 warns against, emphasizing the need to track and update all deployed software and firmware.","Routine vulnerability scanning and time-bound remediation SLAs for internet-facing devices would have ensured this critical CVSS 7.1 flaw was identified and patched before active exploitation began.","A.8.8 mandates timely identification and remediation of technical vulnerabilities in information systems, which directly applies to tracking and patching this disclosed SonicOS flaw before exploitation occurs.","This control calls for robust authentication mechanisms to be protected from bypass; the MFA circumvention here directly violates the assurance that PR.AA expects organizations to maintain around access controls."]