OfficialCISA Known Exploited Vulnerabilities
SonicWall SonicOS SSLVPN Use of Single-factor Authentication VulnerabilityType Vulnerability
SonicWall
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
3 sourcesCVE-2026-19868
At a glance
High
Suggested 24-hour window, counted from the last update
ActiveConfirmed in-the-wild exploitation
Evidence-weighted, not popularity
Signal
Actively exploited in the wild — prioritise confirming exposure.
Why High
High rather than Critical: exposure is scored at a default because we cannot see your systems or suppliers. If you run or depend on SonicWall SonicOS SSLVPN, treat it as Critical.
Briefing
- Organisations using SonicWall SonicOS SSLVPN should verify if they are affected by CVE-2026-19868 and assess their authentication configurations.
Questions to ask IT
- Do we run SonicWall SonicOS SSLVPN, and which versions?
- Is any of it reachable from the internet?
- Have we checked whether it has already been used against us?
- If it is still not patched, what mitigation is in place, and what is holding the fix up?
Next steps
- Confirm exposure and remediation status for affected products
Vulnerability facts
Full CVE detail CVE-2026-19868- 7.5 · HighExploitable over the network without any account, under specific conditions, and no one has to click or open anything. High impact on confidentiality; low on integrity, and it can reach beyond the vulnerable system.CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
- Listed: attacks using it have been seen (on the catalogue since )
- ~0.6% estimated chance of attack in 30 days
- Not linked from the CVE record
- CVE-2026-19868 is confirmed as exploited in the wild according to the US known-exploited catalogue.
Next steps
- Confirm whether affected products/versions are present and prioritise patching or mitigations
Summary
- A vulnerability in SonicWall SonicOS SSLVPN allows attackers with credentials from a different login method to bypass SAML checks, including SAML-enforced MFA.
Products and services involved
- SonicWall SonicOS SSLVPN88% match confidence · CVE-2026-19868
5 reports
Part of Authentication bypass vulnerabilities in enterprise software
Same event, different frames
Distinct often headline the same incident differently.
OfficialCISA Cybersecurity Advisories
CISA Adds One Known Exploited Vulnerability to CatalogNewsSecurityWeek
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN LoginsPulse
Last change yesterday · Recheck overdue since 7 Nov 2026, 17:33 UK time
- Story6 Nov 2026, 21:33 UK time · 2d ago
Linked reporting from CISA (official authority).
Read source (CISA Known Exploited Vulnerabilities) - Story6 Nov 2026, 21:33 UK time · 2d ago
Linked reporting from CISA Cybersecurity Advisories (official authority).
Read source (CISA Cybersecurity Advisories) - Story7 Nov 2026, 11:33 UK time · yesterday
Linked reporting from SecurityWeek (independent original reporting).
Read source (SecurityWeek)
3 entries so far. The timeline chart appears once this story has more history.
Sources
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- CISA Cybersecurity AdvisoriesOfficial
CISA Adds One Known Exploited Vulnerability to Catalog
- SecurityWeekNews
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
How we know
Statements extracted from sources. Higher confidence means stronger corroboration.
- ClaimedHeadline60% confidence
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
- ProbableSummary fact75% confidence
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.
- ConfirmedCVE identifier95% confidence
Event involves CVE-2026-19868
- ConfirmedKnown-exploited catalogue98% confidence
CVE-2026-19868 is confirmed as exploited in the wild (US known-exploited catalogue)