GoKawiilSonicWall patches actively exploited SSL-VPN MFA bypass flaw in SonicOS
SonicWall has released security updates addressing seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass that lets attackers with valid alternate credentials evade SAML authentication, including SAML-enforced MFA. SonicWall confirmed it is investigating a report of active exploitation, and CISA has added the flaw to its Known Exploited Vulnerabilities catalog, directing federal agencies to patch by November 20, 2026. The fix also covers two 8.8-severity management interface bugs, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing issue on virtual appliances.
GoKawiil's interpretation of the reporting above, not reported fact.
The flaw's inclusion in CISA's KEV catalog signals confirmed real-world exploitation, which could put organizations relying on SonicWall SSL-VPN with SAML-based MFA at heightened risk until patched. SonicWall's SSL-VPN products have been repeatedly targeted by threat actors in past campaigns, so unpatched systems may be attractive to attackers seeking network access. The accompanying management interface and buffer overflow flaws suggest a broader push by SonicWall to close multiple attack surfaces simultaneously.
- CVE-2026-19868 allows SAML authentication and MFA bypass on SonicOS SSL-VPN services.
- CISA confirmed active exploitation and set a November 20, 2026 patch deadline for federal agencies.
- The update also fixes six other flaws, including two 8.8-severity unauthenticated management interface bugs.
YubiKey 5 NFC Security Key — With authentication bypass flaws like this SonicWall SSL-VPN issue making headlines, hardware-based MFA like a YubiKey adds a strong extra layer of protection beyond software-based methods. It's a simple way for individuals and IT admins alike to harden their own account security against credential-based attacks.
See YubiKey 5 NFC Security Key on Amazon → Affiliate link — we may earn a commission on purchases, at no extra cost to you. Product picked by AI based on this article; it is not a tested recommendation.Source: bleepingcomputer.com, 2026-11-06
Published there as: “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.