SonicWall patches exploited SonicOS flaw that weakens VPN logins
VULNERABILITYSonicWallredteam/daily · 5 sources
- Severity
- High
- Highest CVSS
- 7.5
- Exploited
- Yes
- Sources
- 5
What happened
SonicWall has patched CVE-2026-19868, a SonicOS authentication weakness that is reported as exploited. An attacker with valid credentials for an alternative authentication method can bypass SAML checks, including SAML-enforced MFA, when accessing VPN logins. Defenders should apply the SonicWall patch to affected SonicOS devices as a priority and review VPN authentication logs for logins that bypassed SAML or MFA.
For security analysts · Written by AI from 5 sources · Wrong?
What to do
- Apply the SonicWall patch for CVE-2026-19868 to affected SonicOS devices.
- Review VPN authentication logs for logins that may have bypassed SAML or MFA checks.
Written by AI from the sources, checked against them
Vulnerabilities
Full story timeline · 7 updates
- Fri 6 NovemberCVE-2026-19868 added to CISA’s exploited listCISA KEV
- CISA Adds One Known Exploited Vulnerability to CatalogCISA Alerts
- CVE-2026-19868 published, CVSS 7.5NVD
- SonicWall security advisory (AV26-1133)Canadian Centre for Cyber Security
- Sat 7 NovemberHackers Exploit SonicWall SSL-VPN Vulnerability to Bypass Multi-Factor Authentication in Active AttacksGBHackers
- U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalogSecurity Affairs
- SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN LoginsSecurityWeek
Who reported · 5 outlets
CISA AlertsCanadian Centre for Cyber SecurityGBHackersSecurity AffairsSecurityWeek
Who and what is in it
Companies
Products