Covered by 3 outlets — first reported by BleepingComputer, Nov 7, 00:00 UTC
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
MentionsSonicWall
Summary
SonicWall has released security updates for its SonicOS firewalls that fix seven vulnerabilities, including a flaw in the SSL-VPN remote-access service that can bypass multi-factor authentication and that has been exploited in attacks. The flaw is tracked as CVE-2026-19868, and the US cyber agency CISA has flagged it as possibly exploited in real-world attacks. Coverage cites severity scores of 7.5, with one outlet also noting a 7.1 rating.
AI summary by the SecurityTabs newsroom, checked against BleepingComputer, The Hacker News. Read the outlets below for the full story.
Continue reading
3 outlets, in the order they reported it.
BleepingComputerFirst report
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
The Hacker News
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been…
Help Net Security
Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication.
Explained
The technology and terms in this story. Learn more
- ProtocolSSL · Secure Sockets LayerThe retired predecessor of TLS; the name lives on in product names such as OpenSSL and "SSL VPN".
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
- DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.
- WeaknessAuthentication bypassA flaw that lets someone in without valid credentials.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.