SonicWall Patches Exploited SonicOS security flaw That Weakens VPN Logins

What happened

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog on the same day. Tracked as CVE-2026-19868 , the flaw affects the SSL (the encryption that secures a connection to a website) VPN component of SonicOS, the operating system that runs on SonicWall firewalls (a barrier that decides which network traffic may pass).

Vulnerabilities CVE-2026-19868 (the public catalogue number for a specific software flaw) can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA (a second proof of identity beyond the password). It’s one of seven vulnerabilities described in an advisory published on November 6. “An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA),” reads SonicWall’s description of CVE-2026-19868. According to the vendor, an SSL VPN is exposed only if SAML-based login is enabled. CVE-2026-19868 has a CVSS score of 7.1, which puts it in the high-severity range. The flaw was reported by Ryan Harris of The Electronic Office. SonicWall said its product security team “has investigated a report indicating potential exploitation of this vulnerability.” Under Binding Operational Directive 26-04, federal agencies must address it by November 20.