U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog.

SonicWall mahnt zum zügigen Update: Angreifer missbrauchen eine Sicherheitslücke im SSLVPN von SonicOS. Auch die CISA warnt.

U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added a SonicWall SonicOS SSLVPN flaw, tracked as CVE-2026-19868 (CVSS score of 7.5), to its Known Exploited Vulnerabilities (KEV) catalog. CVE-2026-19868 is an authentication bypass vulnerability affecting the SSL VPN service in SonicWall SonicOS. […]

SonicWall SonicOS の SSLVPN に、SAML 認証と MFA を回避されうる欠陥（CVE-2026-19868）。CISA が KEV に追加。SonicOS 7.3.3-7015 以前・8.2.2-8015 以前が対象。

SonicWall mahnt zum zügigen Update: Angreifer missbrauchen eine Sicherheitslücke im SSLVPN von SonicOS. Auch die CISA warnt.

SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks. Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1. The company has investigated a report indicating potential exploitation and strongly urges customers to upgrade promptly. The issue affects SSLVPN only when SAML is enabled for logins. An attacker must have valid credentials for an alternate authentication method, making this different from a login bypass that requires no account. Under affected conditions, those credentials may allow access without passing the SAML controls intended to protect the connection. SAML lets organizations use a central identity provider to handle user sign-ins. Here, the weakness concerns authentication enforcement through another login method, rather than a stated flaw in SAML itself. Successful exploitation may also skip MFA enforced through SAML, leaving a gap between the security policy administrators expect and the checks actually applied. Ryan Harris of The Electronic Office reported the vulnerability. SonicWall includes it among seven issues in its latest advisory. Although the exploitation warning raises urgency, the supplied details do not identify attackers, victims, attack dates, or the scale of activity. Describing a confirmed widespread campaign would therefore go beyond the available evidence. Earlier SonicWall SSLVPN authentication bypass coverage shows why remote access flaws deserve attention. However, that reporting concerns CVE-2024-53704, a separate vulnerability. Its session-hijacking behavior should not be treated as evidence of how CVE-2026-19868 works or what attackers have done with this newly disclosed issue. SonicOS SSLVPN Vulnerability Exploited The SonicWall security advisory , published November 6, also lists CVE-2026-107155 and CVE-2026-107154. Both score 8.8 and affect the management interface. They involve a permissive cross-domain policy and session validation, respectively, and could permit unauthorized operations under specific conditions. Their vectors include required user interaction. CVE-2026-82308 is a pre-authentication heap buffer overflow in SSLVPN, rated 7.5. CVE-2026-77708 and CVE-2026-77709 affect the TACACS+ authentication client, and each scores 5.9. These flaws could cause application-level denial of service. CVE-2026-19703, rated 5.2, could expose a limited platform credential on virtual appliances to an attacker with existing local access. Affected releases include Gen7 hardware and NSv appliances running SonicOS 7.3.3-7015 or earlier, and Gen8 hardware and NSv appliances running 8.2.2-8015 or earlier. SonicWall lists fixes in 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. No workaround is listed. Administrators should prioritize patching, confirm their appliance generation, and install the matching fixed release. Previous SonicOS vulnerability reporting covers different flaws and firmware fixes, so older patch guidance should not replace this advisory’s requirements. Review enabled authentication methods and check VPN login activity while completing the upgrade. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA appeared first on Cyber Security News .

CISA added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog , warning that valid-credential users can bypass SAML authentication controls and potentially evade multi-factor authentication. CISA added the vulnerability on November 6, 2026, and set a November 20 remediation deadline. Its entry lists ransomware use as unknown and does not require forensic triage under Binding Operational Directive 26-04. Organizations should still assess their exposure and follow the required vendor guidance. SonicWall SonicOS SSLVPN Vulnerability Exploited The vulnerability affects authentication enforcement in SonicOS SSLVPN. According to the CVE record, someone with valid credentials for an alternate authentication method may bypass the controls applied through SAML. Successful exploitation may also bypass MFA enforced through that SAML login process. SAML allows an organization to manage sign-ins through a central identity provider. The risk here is that another authentication route may allow access without completing the expected checks. This is not described as a password-free attack. Valid credentials for an alternate method remain required. The flaw is classified as CWE-308, or use of single-factor authentication . This weakness occurs when a system accepts one authentication factor, such as a password, when it should require additional checks. The result can undermine protection even when administrators believe MFA covers remote access. The CVE record identifies affected Gen7 and Gen8 platforms running SonicOS 7.3.3-7015 and earlier, and 8.2.2-8015 and earlier, respectively. Cybersecurity News’ earlier SonicWall SSLVPN vulnerability report lists fixed releases as 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, or later supported versions. The reported CVSS score is 7.1. SonicWall’s warning initially described a report of potential exploitation. CISA’s subsequent catalog entry raises the urgency for defenders. However, the available information does not identify the attackers, affected organizations, or the number of confirmed incidents. Ransomware involvement should not be presented as established. Previous SonicWall authentication bypass attacks involved CVE-2024-53704 , a separate flaw that allowed session hijacking without authentication. Those attack details should not be applied to this vulnerability, which has different access requirements. Administrators should check appliance models, firmware versions, SAML settings, and internet exposure before applying the matching update. The SonicWall security advisory should guide deployment decisions. Published coverage lists no workaround, making the firmware upgrade the main remediation step. Security teams should also review enabled login methods and VPN activity for unexpected access. An MFA setting alone should not be treated as proof that every authentication route enforces the same checks. Confirming those controls after patching helps ensure the intended remote access policy is actually applied. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post CISA Warns of SonicWall SonicOS SSLVPN Vulnerability Exploited in Attacks appeared first on Cyber Security News .

SonicWall urges prompt updates: Attackers are exploiting a SonicOS SSLVPN vulnerability. CISA is also warning users.

SonicWall urges prompt updates: Attackers are exploiting a SonicOS SSLVPN vulnerability. CISA is also warning users.

CISA has added a SonicWall SonicOS SSLVPN flaw to its exploited-vulnerabilities list. It can let someone holding valid credentials for another sign-in method skip stronger login controls, including multi-factor checks.

CISA added CVE-2026-19868 to its KEV catalog, warning that the SonicWall SSLVPN flaw allows valid users to bypass SAML authentication and MFA.

Decoded in plain English on XploitDigest.

Eine Recherche zeigt: Gehirnaktivitäten von Neurotech-Nutzern werden ohne deren Wissen für das Training von KIs verwendet.

Blog sobre informática, tecnología y seguridad con manuales, tutoriales y documentación sobre herramientas y programas

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enf…

U.S. CISA adds SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog.

SonicWall released fixes for CVE-2026-19868, an exploited SonicOS SSLVPN flaw that can bypass SAML authentication and MFA on affected Gen 7 and Gen 8 firewalls.

SonicWall patched CVE-2026-19868, an actively exploited SAML authentication bypass in SonicOS SSLVPN that lets attackers with valid alternate credentials circumvent MFA. CISA added it to the KEV catalog with a November 20, 2026 federal deadline.