Vulnerability · high · CVSS 7.5
SonicWall SonicOS SSL-VPN MFA bypass flaw, reported as exploited
Tier A · Patch today – Before you go home
Who’s exposed: Organisations running SonicOS firewalls with SSL-VPN and SAML-enforced MFA
Tier A because: Core infrastructure or popular tool AND exploited in the wild
Reach
Attack
Damage
Fix
Popular tool · Exploited in the wild · Remote, no login
What to do
- Apply the SonicOS security updates from SonicWall that fix CVE-2026-19868 and the other six flaws.
- Review VPN login logs for signs of SAML or MFA bypass activity.
The Brief
- SonicWall released security updates fixing seven vulnerabilities in SonicOS firewalls.
- CVE-2026-19868 is an SSL-VPN authentication bypass that lets attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA.
- CVE-2026-19868 has a CVSS score of 7.5 and is listed in CISA's Known Exploited Vulnerabilities catalog.
Why it matters
SonicOS SSL-VPN is often exposed to the internet, and this flaw weakens MFA-protected VPN logins for organisations that rely on SAML. Since the flaw is already exploited, unpatched firewalls are at active risk.
The checklist behind the tier
Checklist · 4 of 10 yes
| Yes | Hits tech teams | Judgment: SonicOS firewalls are network security appliances that IT and ops teams run. |
| No | Core infrastructure | Judgment: a single vendor's firewall appliance, not software nearly every team runs. |
| Yes | Popular tool | Judgment: SonicWall firewalls are a widely deployed appliance used by many organizations. |
| Yes | Exploited in the wild | CISA SSVCCISA rates exploitation of CVE-2026-19868 as active |
| No | Public exploit | No source says exploit code or a proof-of-concept is published. |
| Yes | Remote, no login | CVSSCVE-2026-19868: CVSS 7.5 – network, no privileges, no user interaction |
| No | Full takeover | CVSSCVSS: no CVE has both high confidentiality and integrity impact |
| No | Secrets exposed | No source reports credentials, configs or data stolen or exposed. |
| No | Supply chain | Sources describe a SonicOS login flaw, not malicious code shipped through a trusted channel. |
| No | No fix yet | BleepingComputer: SonicWall has released security updates fixing the seven vulnerabilities. |
The official record
From CVE.org, CISA’s Known Exploited Vulnerabilities catalog, FIRST EPSS and the GitHub Advisory Database. Where these answer a checklist fact, they win over the reporting.
CVE-2026-19868 ↗CVSS 7.5 high AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- Exploited
- CISA rates exploitation active
- EPSS
- <1% chance of exploitation in the next 30 days · higher than 50% of all CVEs
- Weakness
- CWE-308
Timeline
SonicWall releases security updates fixing seven SonicOS flaws, including CVE-2026-19868
CISA adds CVE-2026-19868 to its Known Exploited Vulnerabilities catalog
BleepingComputer
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
Security Affairs
U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog
SecurityWeek
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
The Hacker News
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
Full coverage · 4 sources
First seen · 4 sources · Full story page · How tiers are decided