CompTIAAvailable
N10-009
CVE-2026-19868 SonicWall SonicOS SSLVPN Vulnerability
CVE-2026-19868 lets a user with valid credentials for an alternate authentication method bypass SAML controls, including SAML-enforced MFA, on SonicOS SSLVPN. CISA added it to its KEV catalog on 2026-11-06.
Short answer: CVE-2026-19868 is a high-severity (CVSS 7.5) flaw in the SonicOS SSLVPN service. It can let someone with valid alternate-method credentials skip SAML authentication and SAML-enforced MFA. CISA lists it as exploited, so follow SonicWall's advisory SNWLID-2026-0014 and finish by 2026-11-20 if you are a federal agency.
What happened
SonicWall SonicOS SSLVPN has an authentication flaw, tracked as CVE-2026-19868. A user with valid credentials for an alternate authentication method may bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
The NVD record was published on 2026-11-06. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day. The weakness is classed as CWE-308, use of single-factor authentication.
Who is affected
Anyone running the SonicOS SSLVPN service is in scope. The risk is highest where SAML is your intended login path and another authentication method still works on the same SSLVPN service.
Check the SonicWall advisory SNWLID-2026-0014 for the exact fixed releases.
Here is a simple way to see where you stand:
Your setup | Exposure |
|---|---|
SSLVPN reachable from the internet, SAML plus MFA enforced, other auth methods also enabled | Highest. This is the scenario the CVE describes. |
SSLVPN reachable from the internet, SAML is the only method | Lower, but still follow the vendor steps. |
SSLVPN only reachable from internal networks | Lower. An attacker needs internal access first. |
SSLVPN disabled | Not exposed through this service. |
CISA also tells stakeholders to evaluate each asset's internet exposure themselves. Do that inventory first.
How serious it is and whether it is exploited
NVD lists a CVSS score of 7.5 HIGH with the vector CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N. Read that vector this way:
It is reachable over the network (
AV:N).Attack complexity is high (
AC:H).No privileges or user interaction are needed (
PR:N,UI:N).Scope changes (
S:C), and confidentiality impact is high (C:H).
The vector lists no privileges required (PR:N), yet the attacker still needs valid credentials for an alternate authentication method. The flaw does not mean anyone can connect with no credentials at all.
The CISA KEV listing is the key signal. CISA lists it in its Known Exploited Vulnerabilities catalog. The federal due date is 2026-11-20. Known ransomware use is listed as Unknown.
The damage is that your MFA gate may not apply. Stolen or reused credentials become much more useful.
A worked example
Say your firewall sends staff to your identity provider through SAML, with MFA. The same SSLVPN service still accepts another login method, such as a local account.
An attacker has a leaked password for that other method. Under this flaw, they may reach the VPN without the SAML step and without the MFA prompt. Your identity provider logs may show nothing, because the attempt may never reach it.
That is why you check the firewall's own logs, not only your identity provider's.
What to do now
CISA's required action is to apply mitigations in line with vendor instructions. It also requires compliance with BOD 26-04 (Prioritizing Security Updates Based on Risk) and CISA's "Forensics Triage Requirements." For cloud services, follow the applicable BOD 26-04 guidance. If mitigations are unavailable, discontinue use of the product.
Work through this order:
Read SNWLID-2026-0014 and note the fixes and mitigations.
List every SonicWall device with SSLVPN enabled and mark which ones face the internet.
Apply the vendor's mitigation or fix to internet-facing devices first.
Review which authentication methods the SSLVPN service accepts. Remove any alternate method you do not need.
Search logs for logins that skipped SAML (queries below).
Rotate credentials for any account that shows suspicious VPN logins.
Record what you did, so you can show it against the CISA requirements.
Check what is reachable from outside
Run these from a host outside your network. Replace the placeholders with your own SSLVPN hostname, IP and port.
curl -skI https://VPN_HOSTNAME:PORT/ | head -n 5
nmap -Pn -p PORT VPN_PUBLIC_IPIf the portal answers, the service is internet-facing. Treat that device as the top patching priority.
Look for logins that did not use SAML
This assumes your firewall forwards syslog to a file. Adjust the path and match strings to your own log format.
grep -i "sslvpn" /var/log/sonicwall.log | grep -i "login" | grep -vi "saml" | tail -n 200In a SIEM, apply the same idea. Filter to SSLVPN login successes, then exclude events that show the SAML method. Compare the remaining usernames against your staff list and normal login hours. Pay attention to accounts that should only ever sign in through SAML.
If you find something odd
Do not wipe the device first. CISA's "Forensics Triage Requirements" are part of the required action, so preserve logs and configuration before you change anything. Then follow the vendor and CISA guidance.
What IT and security learners can take from this
This bug shows that MFA only helps when it is the only way in. A side door that accepts another method can undo the whole control. Exam objectives on authentication, access control and attack surface reduction describe exactly this problem.
If you are building analyst skills, practice reading a KEV entry, scoring exposure and writing a short response plan. The CompTIA CySA+ CS0-003 voucher ($224.99) covers that kind of work. Vouchers arrive by email within 12 hours.
Browse more study paths in our cybersecurity certifications section.
Sources
Questions about this topic
Does this flaw let anyone log in without a password?
No. The attacker needs valid credentials for an alternate authentication method. The flaw lets them bypass SAML controls and possibly SAML-enforced MFA. A leaked or reused password becomes more dangerous.
Why does the CISA KEV listing matter for private companies?
CISA lists the flaw in its Known Exploited Vulnerabilities catalog. The 2026-11-20 due date applies to federal agencies. Other organizations often use the catalog as a patch-priority signal.
Is a high attack complexity rating a reason to wait?
No. The CVSS vector marks attack complexity as high, but CISA still lists the flaw in its KEV catalog. Handle internet-facing SSLVPN devices first and do not wait for a scheduled maintenance window.
What if SonicWall's mitigation is not available for my device?
CISA's required action says to discontinue use of the product if mitigations are unavailable. For cloud services, follow the applicable BOD 26-04 guidance. Check the SonicWall advisory for your specific device first.
Should I check my identity provider logs for this?
They are worth reviewing, but they may show nothing. A bypass of SAML may never reach your identity provider. Start with the firewall's SSLVPN login logs.
