Exploited SonicOS SSLVPN flaw CVE-2026-19868 lets valid credentials bypass SAML-enforced MFA
The bypass needs working credentials for a second sign-in method, so an SSLVPN using SAML with another method still enabled is the case to check. CISA records ransomware use as unknown.
Affects
SonicWall SonicOS SSLVPN
What to do
List non-SAML sign-in methods on every SSLVPN device, apply SonicWall's mitigations in SNWLID-2026-0014, then reset those accounts' passwords.
- KEV listed
- Published
- CVE
- CVE-2026-19868
- CVSS
- 7.5 (v3.1, CNA, via NVD)
- Exploitation
- Exploited, in the CISA catalogue
- Affected
- SonicWall SonicOS SSLVPN
How the flaw works
An attacker needs valid credentials for an alternate authentication method on the SSLVPN service. Those can bypass SAML authentication controls, and SAML-enforced MFA may fall with them. CISA names the weakness as use of single-factor authentication, so remote access can open on one factor where the firm expected two.
What to do now
Start with any device whose SSLVPN relies on SAML for MFA while another sign-in method stays enabled: that is the combination the bypass needs.
- List every sign-in method besides SAML enabled for SSLVPN on each device, and switch off any nobody needs.
- Apply the mitigations in SonicWall's advisory to each device.
- If no mitigation covers your build, take SSLVPN offline, as CISA advises.
- Reset passwords for accounts that can use those other methods.
- Copy SSLVPN logs off the device, compare sessions against identity provider sign-ins, and escalate anything unexplained.
Who is affected
Treat SonicOS with SSLVPN on, SAML in use and a second sign-in method available as exposed. Among those devices at an Australian firm, begin with the one remote staff use to reach client files.
CISA's entry and the NVD record, still undergoing analysis, list no affected versions, and SonicWall's advisory SNWLID-2026-0014 gave only its heading when retrieved on 7 November 2026. Confirm your build against the live advisory.
Detection notes
Neither CISA nor NVD publishes indicators, and CISA's required action points to its forensics triage requirements. These signs follow from how the bypass works, and any indicators in SonicWall's advisory take priority.
- SSLVPN sessions with no matching sign-in at the SAML identity provider
- Sessions for SAML-only users authenticated by another method
- SSLVPN sign-ins with no MFA prompt logged for that user at that time
Essential Eight mapping
Patch applications and patch operating systems: the Essential Eight Maturity Model sets 48 hours for internet-facing services and network devices where a working exploit exists, and this flaw is exploited.
Multi-factor authentication: do not count SAML-enforced MFA on SSLVPN as effective until the mitigations are in. Restrict administrative privileges: keep admin accounts off SSLVPN.
Sources
- PrimaryCISA, Known Exploited Vulnerabilities Catalog (release 2026.11.06)Retrieved 7 Nov 2026
- PrimaryNVD, CVE-2026-19868 (published 6 November 2026)Retrieved 7 Nov 2026
- PrimarySonicWall, Security Advisory SNWLID-2026-0014Retrieved 7 Nov 2026
- PrimaryASD, Essential Eight Maturity ModelRetrieved 29 Oct 2026
