{"id":"CVE-2026-19868","kind":"vulnerability","aliases":["CVE-2026-19868"],"related":[],"title":"SonicWall SonicOS SSLVPN: SAML and MFA bypass via alternate login method","description":"SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).\n\nCISA required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","summary":"SonicWall SonicOS SSLVPN, the VPN service on SonicWall firewalls, can let a user who holds valid credentials for an alternate authentication method skip SAML login controls. A successful attack may also bypass SAML-enforced multi-factor authentication.","severity":"unknown","cvss":null,"epss":null,"exploited":true,"exploited_at":"2026-11-06T00:00:00+00:00","products":[{"name":"SonicWall SonicOS SSLVPN","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","saml","sonicos","sonicwall","sslvpn","vpn"],"not_affected_if":["no-saml","sslvpn-disabled"],"how_to_check":"- Confirm whether the SSLVPN service is enabled on the SonicWall firewall and which SonicOS version is running (`unknown` if the sources do not give the check)\n- Check whether SAML authentication is configured for SSLVPN logins\n- Review the SonicOS version against the fixed version list in the vendor advisory (not provided in the sources)","fix":null,"status":"open","published_at":"2026-11-06T00:00:00+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","triaged_at":"2026-11-06T19:46:16+00:00","updated_at":"2026-11-06T20:42:09+00:00","category":"infrastructure","confidence":0.5,"triage":{"at":"2026-11-06T19:46:16Z","model":"claude-haiku-5-5","output":{"fix":"unknown","reach":"internet","title":"SonicWall SonicOS SSLVPN: SAML and MFA bypass via alternate login method","impact":"high","summary":"SonicWall SonicOS SSLVPN, the VPN service on SonicWall firewalls, can let a user who holds valid credentials for an alternate authentication method skip SAML login controls. A successful attack may also bypass SAML-enforced multi-factor authentication.","audience":"businesses","category":"infrastructure","nicknames":[],"who_cares":["sonicwall","sonicos","sslvpn","saml","vpn"],"confidence":0.5,"fix_status":"unknown","needs_auth":"yes","worst_case":"Attacker bypasses SAML and MFA to reach the VPN as a valid user","analyst_note":"Find the SonicWall advisory for CVE-2026-19868 to confirm affected and fixed SonicOS versions and any setting workaround.","how_to_check":"- Confirm whether the SSLVPN service is enabled on the SonicWall firewall and which SonicOS version is running (`unknown` if the sources do not give the check)\n- Check whether SAML authentication is configured for SSLVPN logins\n- Review the SonicOS version against the fixed version list in the vendor advisory (not provided in the sources)","plain_action":"","needs_analyst":true,"not_affected_if":["sslvpn-disabled","no-saml"],"who_is_affected":"Organizations that run SonicWall firewalls with the SonicOS SSLVPN service and rely on SAML or SAML-enforced MFA for VPN logins. Sites that do not use SSLVPN, or that use only non-SAML authentication, are likely not exposed; the sources do not confirm this.","user_interaction":"no","needs_special_setup":"yes","severity_if_unknown":"high"},"cost_usd":0.00074,"input_tokens":4211,"output_tokens":638,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-04':127C,153C,184C '-19868':14A,17A '-2026':13A,16A '26':126C,152C,183C 'accord':116C 'action':112C 'adher':180C 'allow':81C 'also':58B,100C 'altern':9A,47B,89C 'appli':113C 'applic':150C 'asset':174C 'attack':56B 'authent':48B,66B,77C,90C,95C,108C 'base':131C 'bod':125C,151C,182C 'bypass':7A,59B,93C,101C 'cisa':110C,123C,140C 'cloud':156C 'complianc':121C 'contain':70C 'control':53B,96C 'credenti':44B,86C 'cve':12A,15A 'discontinu':159C 'enforc':62B,104C 'ensur':120C,179C 'evalu':172C 'exploit':21B,98C 'exposur':177C 'factor':65B,76C,107C 'firewal':36B 'follow':149C 'forens':142C 'guidanc':138C,154C 'guidelin':186C 'hold':42B 'infrastructur':22B 'instruct':119C 'internet':176C 'let':38B 'login':10A,52B 'may':57B,80C,99C 'method':11A,49B,91C 'mfa':6A,109C 'mitig':114C,165C 'multi':64B,106C 'multi-factor':63B,105C 'note':137C,148C 'patch':185C 'priorit':128C 'product':163C 'requir':111C,144C 'respons':170C 'risk':133C 'saml':4A,23B,51B,61B,94C,103C 'saml-enforc':60B,102C 'secur':129C 'see':134C,145C 'servic':33B,157C 'singl':75C 'single-factor':74C 'skip':50B 'sonico':2A,24B,29B,68C 'sonicos':19A 'sonicwal':1A,25B,28B,35B,67C 'sonicwall':18A 'sslvpn':3A,20A,26B,30B,69C 'stakehold':168C 'success':55B,97C 'triag':143C 'unavail':167C 'updat':130C 'url':135C,146C 'use':72C,160C 'user':40B,83C 'valid':43B,85C 'vendor':118C 'via':8A 'vpn':27B,32B 'vulner':78C","nicknames":[],"mitigations":[],"who_affected":"Organizations that run SonicWall firewalls with the SonicOS SSLVPN service and rely on SAML or SAML-enforced MFA for VPN logins. Sites that do not use SSLVPN, or that use only non-SAML authentication, are likely not exposed; the sources do not confirm this.","tier":"A","verified":{},"analyst_revisit_at":null,"fix_status":"none","audience":"businesses","plain_action":null,"pkeys":["sonicossslvpn","sonicwallsonicossslvpn"],"ptokens":["sonicos","sonicwall","sslvpn"],"labels":["exploited","infrastructure","saml","sonicos","sonicwall","sslvpn","unknown","vendor","vpn"],"campaign_type":null,"search_a":"'-19868':14A,17A '-2026':13A,16A 'altern':9A 'bypass':7A 'cve':12A,15A 'login':10A 'method':11A 'mfa':6A 'saml':4A 'sonico':2A 'sonicos':19A 'sonicwal':1A 'sonicwall':18A 'sslvpn':3A,20A 'via':8A","search_b":"'also':58B 'altern':47B 'attack':56B 'authent':48B,66B 'bypass':59B 'control':53B 'credenti':44B 'enforc':62B 'exploit':21B 'factor':65B 'firewal':36B 'hold':42B 'infrastructur':22B 'let':38B 'login':52B 'may':57B 'method':49B 'multi':64B 'multi-factor':63B 'saml':23B,51B,61B 'saml-enforc':60B 'servic':33B 'skip':50B 'sonico':24B,29B 'sonicwal':25B,28B,35B 'sslvpn':26B,30B 'success':55B 'user':40B 'valid':43B 'vpn':27B,32B","search_c":"'-04':127C,153C,184C '26':126C,152C,183C 'accord':116C 'action':112C 'adher':180C 'allow':81C 'also':100C 'altern':89C 'appli':113C 'applic':150C 'asset':174C 'authent':77C,90C,95C,108C 'base':131C 'bod':125C,151C,182C 'bypass':93C,101C 'cisa':110C,123C,140C 'cloud':156C 'complianc':121C 'contain':70C 'control':96C 'credenti':86C 'discontinu':159C 'enforc':104C 'ensur':120C,179C 'evalu':172C 'exploit':98C 'exposur':177C 'factor':76C,107C 'follow':149C 'forens':142C 'guidanc':138C,154C 'guidelin':186C 'instruct':119C 'internet':176C 'may':80C,99C 'method':91C 'mfa':109C 'mitig':114C,165C 'multi':106C 'multi-factor':105C 'note':137C,148C 'patch':185C 'priorit':128C 'product':163C 'requir':111C,144C 'respons':170C 'risk':133C 'saml':94C,103C 'saml-enforc':102C 'secur':129C 'see':134C,145C 'servic':157C 'singl':75C 'single-factor':74C 'sonico':68C 'sonicwal':67C 'sslvpn':69C 'stakehold':168C 'success':97C 'triag':143C 'unavail':167C 'updat':130C 'url':135C,146C 'use':72C,160C 'user':83C 'valid':85C 'vendor':118C 'vulner':78C","first_public_at":"2026-11-06T00:00:00+00:00","kev":{"dateAdded":"2026-11-06","dueDate":"2026-11-20","requiredAction":"Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":null,"cvss_by":null,"poc_count":0,"sources":[{"source":"nvd","external_id":"CVE-2026-19868","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-19868","severity":null,"published_at":"2026-11-06T19:17:48+00:00","modified_at":"2026-11-06T19:17:48+00:00","first_seen_at":"2026-11-06T19:43:48+00:00","fetched_at":"2026-11-06T19:43:48+00:00","note":null},{"source":"kev","external_id":"CVE-2026-19868","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19868","severity":null,"published_at":"2026-11-06T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-11-06T20:41:30+00:00","fetched_at":"2026-11-06T20:41:30+00:00","note":null}],"documents":[{"id":89650,"url":"https://news.ycombinator.com/item?id=50398020","title":"SonicWall SonicOS SSLVPN auth bypass (CVE-2026-19868)","kind":"post","source":"hackernews","publisher":null,"text":"SonicWall SonicOS SSLVPN auth bypass (CVE-2026-19868)\nhttps://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014\n\n1 points, 0 comments on Hacker News","published_at":"2026-11-06T20:29:21+00:00","relation":"discussion","confidence":null,"note":"1 points, 0 comments"}],"exploit_sources":[{"type":"kev","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2026-19868","date_added":"2026-11-06","due_date":"2026-11-20","ransomware":"Unknown"}],"notice":"Free to read, with fair use of about 60 pages a minute. For higher limits or API access: sales@infrastack.ai"}