Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
MentionsSonicWall
SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly.
Summary from Help Net Security.
Explained
The technology and terms in this story. Learn more
- ProtocolSSL · Secure Sockets LayerThe retired predecessor of TLS; the name lives on in product names such as OpenSSL and "SSL VPN".
- TechnologyVPN · Virtual private networkAn encrypted tunnel that puts a remote device on a private network, as if it were plugged in at the office.
- DefenceMFA · Multi-factor authenticationRequiring a second proof besides a password, such as an app prompt, a code or a security key.
- ConceptExploitCode or a technique that turns a software flaw into something an attacker can actually use.
Why it was possible
The weaknesses behind this story's CVEs, from each CVE Record.
Vulnerabilities in this story
Severity and exploitation facts from NVD, FIRST, and CISA.
Related coverage
Other sources covering the same vulnerabilities or event.
SANS Stormcast Monday, November 9th, 2026: sshole Scans (CVE-2026-123158); SonicWall SonicOS MFA Bypass (CVE-2026-19868); Entra Device Registration (CVE-2026-109469); Claude Code Secrets Leak
Podcast7 minSANS Internet Storm Center StormCast2d agoVulnerabilitiesAIIdentityCVE-2026-109469CVE-2026-123158+1