ZeroDayAlert

CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

SonicWall SonicOS SSLVPN Added to KEV 2026-11-06 Federal due 2026-11-20 Known ransomware use

Required action — quoted from CISA

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Where this comes from. The identifier, product, dates and required action above are copied verbatim from the CISA Known Exploited Vulnerabilities catalog. The action plan below is written by an AI agent from that record and published automatically. AssurePort has not independently tested this vulnerability and makes no claim about whether any specific system is affected.

Who is affected

SonicWall SonicOS SSLVPN deployments are affected by a single-factor authentication bypass. The vulnerability allows a user holding valid credentials for an alternate authentication method to circumvent SAML authentication controls, and potentially to bypass SAML-enforced multi-factor authentication (MFA). The record does not specify which versions of SonicOS or which SSLVPN hardware or virtual appliances are in scope.

How to check whether this touches you

  • Inventory your network perimeter and remote-access infrastructure to identify any SonicWall SSLVPN appliances or virtual instances in production.
  • Confirm whether SAML authentication is configured as the primary or only authentication method on any SonicOS SSLVPN instance, and whether MFA is enforced via SAML.
  • Establish which users or service accounts have credentials valid for alternative authentication methods (such as local authentication, RADIUS, or LDAP) on the same appliances.
  • Determine whether each SSLVPN appliance is reachable from the internet or untrusted networks; consult your firewall rules and any published access logs.
  • Check the SonicOS firmware version running on affected appliances against SonicWall's advisory to identify whether a patched version is available and applicable to your hardware model.

What to do

  1. Obtain SonicWall's mitigation guidance immediately. Consult the vendor's security advisory for this CVE to confirm which firmware versions contain a fix and whether interim workarounds are available.
  2. Assess reachability. Review firewall rules, VPN gateway configurations, and network segments to determine whether your SSLVPN endpoints are exposed to untrusted networks. Document the result.
  3. If you cannot patch within your compliance window, apply available interim controls: restrict access to SSLVPN endpoints by IP address or network segment, disable or revoke alternate authentication methods where operationally feasible, and increase logging of all authentication attempts.
  4. Ensure comprehensive logging is active. Enable and retain logs of all authentication attempts, method selection, SAML assertions, and session creation on affected appliances. Confirm log retention meets your incident investigation window (typically 90 days minimum).
  5. Plan your patching schedule. Align deployment of the patch with CISA BOD 26-04 guidance for your asset's internet exposure. If the appliance is internet-facing, prioritise patching within the federal remediation due date or earlier.
  6. If mitigations are unavailable and your appliances are critical, escalate to your change control board and security leadership to evaluate discontinuation of the product in accordance with CISA guidance.

If you find you were exposed

Exploitation of authentication bypasses typically occurs before public disclosure, so retrospective hunting must work backwards from the disclosure date. Examine your authentication and session logs for the period preceding the CISA KEV addition date (6 November 2026) for anomalies: sessions created via alternate authentication methods when SAML should have been enforced, MFA prompts that were missing or bypassed, or logins by accounts with no history of SSLVPN access. Log retention is your limiting factor; if logs predate your retention window, document that fact and note the retention policy for future reference.

Get these the morning they land.

One email, only when a vulnerability is newly confirmed as exploited — the CISA record plus our action plan. No more than one a day, and nothing on quiet days.

Knowing it exists is not the same as knowing you are exposed.

This page can tell you that CVE-2026-19868 is being exploited. It cannot tell you whether SonicOS SSLVPN is running somewhere of yours that is reachable. That question is what a scan answers.

Check your own surface →