CVE-2026-19868
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
- CVSS
- —
- EPSS
- —
- CISA KEV
- Added 2026-11-06, due 2026-11-20
- Exploitation
- active
- Public exploits
- None seen
- State
- PUBLISHED
Coverage
Actively exploitedCritical 100SecurityWeekSpecialist. Specialist publisher: established trade press, or expert analysis with a track record
SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
CVE-2026-19868 can let attackers holding credentials for a different login method get past SAML checks, including SAML-enforced MFA. The post SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins appeared first on SecurityWeek.
Actively exploitedCritical 100Canadian Centre for Cyber SecurityAuthoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
SonicWall security advisory (AV26-1133)
Serial number: AV26-1133 Date: November 6, 2026 As of November 6, 2026, SonicWall is affected by a vulnerability in the following product: SonicOS prior to 7.3.4-7013 prior to 8.2.2-8015 SonicWall indicates that CVE-2026-19868 is being exploited. On November 6, 2026, Cybersecurity and…
Actively exploitedCritical 100CISA advisories & alertsAuthoritative. Authoritative publisher: a primary source, or a newsroom with formal editorial standards
CISA Adds One Known Exploited Vulnerability to Catalog
CISA has added one new vulnerability to its Known Exploited Vulnerabilities (KEV) Catalog, based on evidence of active exploitation. CVE-2026-19868 SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability This type of vulnerability is a frequent attack vector for malicious cyber…
What we observed
- kev addedcisa-kev