SonicWall patches exploited SonicOS vulnerability allowing VPN login bypass

SonicWall has patched seven SonicOS vulnerabilities, including an SSL VPN flaw that has been exploited in active attacks, SecurityWeek reported. The primary flaw, tracked as CVE-2026-19868, affects the SSL VPN service of the SonicOS operating system running on SonicWall firewalls. SecurityWeek and CISA Alerts both report that the vulnerability has been actively exploited. [1][2]

According to SecurityWeek, the authentication enforcement vulnerability allows an attacker holding valid credentials for an alternate authentication method to bypass SAML checks. This issue includes bypassing SAML-enforced multi-factor authentication. SonicWall issued an advisory describing the flaw and six other vulnerabilities on November 6. [1]

The Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog on November 6 based on evidence of active exploitation, CISA Alerts reported. CISA noted that single-factor authentication vulnerabilities in the SonicOS SSLVPN component pose significant risks to the federal enterprise, citing Binding Operational Directive 26-04 for vulnerability management updates. [2]

As FTMQ Security reported earlier, CISA added the SonicOS SSLVPN vulnerability to its catalog after observing active exploitation. The addition requires Federal Civilian Executive Branch agencies to follow remediation requirements set under Binding Operational Directive 26-04. [5]