Summary

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is…

For more information, read the full story at the original source: Help Net Security ↗

Vulnerabilities in this story

• CVE-2026-19868 KEV · fix by 2026-11-20 SonicWall SonicOS EPSS 0.6% 7.5High

Also reported by

• The Hacker News: CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation ↗
• SecurityWeek: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins ↗
• Security Affairs: U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog ↗
• BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks ↗