SonicWall SonicOS SSLVPN MFA bypass CVE-2026-19868 exploited

CISA added a SonicWall SonicOS SSLVPN flaw, CVE-2026-19868, to its Known Exploited Vulnerabilities (KEV) catalog on 6 November 2026, which means it is being exploited in the wild. The bug lets a user who holds valid credentials for a different authentication method sidestep SAML authentication, and with it any SAML-enforced multi-factor authentication. Under the CISA KEV listing, US federal agencies must apply mitigations by 20 November 2026; every other SonicWall SSLVPN operator should treat that date as a sensible outer limit.

What happened

CISA catalogued the issue as a SonicWall SonicOS SSLVPN use of single-factor authentication vulnerability. NVD published its record on 6 November 2026 and rates it CVSS 7.5 (High), with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. In plain terms: it is reachable over the network, the attacker needs no privileges on the appliance, and the difficulty rating is high because exploitation depends on specific conditions, here the attacker already holding valid credentials for some other login method.

The weakness is classed as CWE-308, use of single-factor authentication. SonicWall tracks the issue as SNWLID-2026-0014 in its PSIRT portal, which NVD references.

Am I affected?

• Product: SonicWall SonicOS, SSLVPN service.
• Most exposed: appliances where SSLVPN logins are meant to be protected by SAML single sign-on and MFA, and where another authentication method (for example local or directory accounts) is also enabled for the same service.
• Affected and fixed versions: not listed in the NVD record or the CISA entry. Check the SonicWall advisory for the exact builds that apply to your hardware or virtual appliance.

If you do not expose SSLVPN to the internet, your risk is lower, but internal attackers with stolen credentials could still use the same path.

Technical details

• Attack vector: network, against the SSLVPN login.
• Impact: NVD scores confidentiality impact as high and integrity impact as low, with a changed scope, so a successful login can reach resources beyond the VPN service itself.
• Exploitation status: listed in CISA KEV on 6 November 2026, due date 20 November 2026.
• Ransomware use: CISA lists known ransomware campaign use as unknown.
• Attacker identity: no threat actor has been named in the available records.

CISA’s required action is to apply mitigations in line with vendor instructions and its binding operational directive guidance, including its forensics triage requirements, or to stop using the product if mitigations are not available.

Why this matters

Analysis, not new facts. Multi-factor authentication is usually the control that makes a stolen password far less useful. A flaw that lets a credential for another login method skip the SAML step turns a phished or reused password into working VPN access. SSLVPN endpoints face the internet by design, so they are scanned constantly, and a KEV listing means someone has already made this work in practice. Because the initial access would look like a normal authenticated login, it is easy to miss unless you review how each session authenticated.

Prioritisation: with confirmed exploitation, patch or mitigate within hours to days, not at the next maintenance window. Internet-facing appliances come first.

Detection and hunting ideas

• Review SSLVPN logs for successful logins that did not go through the SAML identity provider, especially for accounts that normally use SSO with MFA.
• Compare VPN login records against your identity provider’s sign-in logs and look for VPN sessions with no matching MFA event.
• Look for new source IP addresses, unusual hours or geographies, and sessions that quickly move to internal admin systems.
• If you find suspicious sessions, reset the affected credentials, revoke active sessions and follow your incident process. CISA’s forensics triage expectations are a useful checklist.

No indicators of compromise have been published in the sources for this CVE.

What to do

1. Read the SonicWall advisory SNWLID-2026-0014 and apply the mitigations or updates it specifies for your SonicOS builds.
2. Inventory every SonicWall appliance with SSLVPN enabled and note which authentication methods are active on each.
3. Disable authentication methods that are not needed for SSLVPN so that SAML with MFA is the only path, where the vendor guidance allows it.
4. Restrict SSLVPN exposure to known networks where practical until you are confident the appliance is mitigated.
5. Hunt through VPN and identity provider logs for the pattern above, covering the period before CISA’s 6 November listing.
6. Record completion before 20 November 2026 if you are bound by CISA’s directive, and tell your incident response team and management that MFA on SSLVPN may have been bypassable.

The vendor has not published fixed versions in the records available for this CVE, so confirm the current guidance directly with SonicWall before closing the ticket.

Related free tool: test how long a password would take to crack with our Password Strength Checker. It runs entirely in your browser and nothing you type is sent or stored.

Related coverage

• Linux kernel CVE-2026-46300 added to CISA KEV, exploited
• Collabora CODE Server flaw exploited in Nextcloud (CVE-2026-110447)
• Arista VeloCloud Orchestrator flaw exploited (CVE-2026-114625)

Sources

• CISA Known Exploited Vulnerabilities catalog: CVE-2026-19868
• NVD: CVE-2026-19868
• SonicWall PSIRT advisory SNWLID-2026-0014