SecurityOnlineDo Son
Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA
Part of the CVE-2026-19868 story · since 6 Nov
- Fri 6 Nov, 20:30 UTC. CISA, first report. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
- Fri 6 Nov, 20:47 UTC. cybersixt, its first report on the story. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins. Cites a CVE in CISA KEV.
- Sat 7 Nov, 00:30 UTC. SecurityOnline, its first report on the story. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA. Cites a CVE in CISA KEV. This article, 3rd of 5.
- Sat 7 Nov, 10:30 UTC. Security Affairs, its first report on the story. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog. Cites a CVE in CISA KEV.
- Sat 7 Nov, 11:00 UTC. SecurityWeek, its first report on the story. SonicWall patches exploited flaw that weakens VPN logins. Cites a CVE in CISA KEV.
Attackers are exploiting SonicWall SonicOS SSLVPN flaw CVE-2026-19868 in the wild, enabling a single-factor login to bypass SAML checks and skip multi-factor authentication where SAML is enabled for SSLVPN logins. The vulnerability is described as an authentication enforcement issue (CWE-308) that allows a user with valid credentials for an alternate method to defeat SAML checks, and CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities catalogue.
SonicWall’s own SNWLID-2026-0014 advisory confirms real-world abuse and urges customers to upgrade to the latest release, noting no workarounds for the flaw. The issue is specifically tied to the SonicOS SSLVPN interface when SAML is enabled.
The report also details seven related CVEs affecting Gen7 and Gen8 SonicWall SonicOS SSLVPN and firewall appliances. CVE-2026-107154 (IP session checks) and CVE-2026-107155 (loose cross-domain policy) affect the web admin portal with high impact, while three pre-auth buffer overflows—CVE-2026-82308 (SSL-VPN heap overflow), CVE-2026-77708 and CVE-2026-77709 (TACACS+ client stack/heap overflows)—permit remote code execution or service crashes.
CVE-2026-19703 (CVSS 5.2) allows local users to read a limited password on virtual hosts due to weak hashing. Affected hardware includes Gen7 on SonicOS 7.3.3-7015 and older, and Gen8 on 8.2.2-8015 and older. Patches mandate upgrading Gen7 to SonicOS 7.3.4-7013+ and Gen8 to 8.2.3-8015+. Admins should review SAML-login activity for MFA-skipping events and apply updates promptly.
How the story developed
5 articles from 5 outlets since 6 Nov. Still developing; the latest report was 7 hours ago. This was the 3rd report, 4 hours after the first.
- Fri 6 Nov, 20:30 UTC. CISA, first report. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
- Fri 6 Nov, 20:47 UTC. cybersixt, its first report on the story. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins. Cites a CVE in CISA KEV.
- Sat 7 Nov, 00:30 UTC. SecurityOnline, its first report on the story. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA. Cites a CVE in CISA KEV. This article, 3rd of 5.
- Sat 7 Nov, 10:30 UTC. Security Affairs, its first report on the story. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog. Cites a CVE in CISA KEV.
- Sat 7 Nov, 11:00 UTC. SecurityWeek, its first report on the story. SonicWall patches exploited flaw that weakens VPN logins. Cites a CVE in CISA KEV.
- Known exploited CVE
- No CVE
- Larger: an outlet’s first report
- Square: official source
- Coverage over time
Show all 5 articles as a listHide the list
- Fri 6 NovDay 02
- CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue20:30 · CISA · official · First report · CISA alert · Known exploited CVE
- SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins20:47 · cybersixt · Known exploited CVE
- Sat 7 NovDay 13
- Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA00:30 · SecurityOnline · Known exploited CVE · This article, 3rd of 5