> ## Content Index
> Fetch the complete content index at: https://stackurity.ai/blog/llms.txt
> Use this file to discover other available public pages before exploring further.

# SonicWall SSLVPN flaw CVE-2026-19868 can bypass SAML and MFA
- URL: https://stackurity.ai/blog/sonicwall-sonicos-sslvpn-cve-2026-19868-saml-mfa-bypass-exploited/
- Published: 2026-11-07T02:05:04.000Z
- Updated: 2026-11-07T02:05:04.000Z
- Description: CISA lists CVE-2026-19868 in SonicWall SonicOS SSLVPN as exploited. It can bypass SAML sign-in and MFA. See what to do and what Stackurity does not cover.
- Author: Stackurity Research Team
- Tags: Actively Exploited, News

**TL;DR:** CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN flaw that can bypass SAML sign-in and the multi-factor check behind it, to its exploited list. Apply SonicWall's mitigation. Stackurity does not cover this product.

## What happened

CISA [announced](https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog) on November 6, 2026 that it had added one flaw to its Known Exploited Vulnerabilities catalogue, based on evidence of active exploitation. The entry is CVE-2026-19868 in SonicWall SonicOS SSLVPN, listed as a use of single-factor authentication. Put simply, someone who can sign in through a different method may be able to skip the SAML checks on the VPN, and that can also defeat the multi-factor authentication SAML enforces.

Federal agencies have until November 20, 2026 to act, and that date is a sensible target for any organization with an SSLVPN exposed to the internet. The catalogue entry asks for the vendor's mitigations and for a check on whether the device was compromised before it was patched. The catalogue entry does not name a fixed firmware version, so take it from SonicWall's own advisory.

## Am I affected?

You are affected if you run SonicWall SonicOS with the SSLVPN service and use SAML for sign-in. Look at the firmware version in the device's management page and compare it with the vendor advisory. Until the device is updated, reduce exposure by limiting who can reach the VPN portal, and review recent sign-ins for accounts that authenticated in unexpected ways.

## How to check with Stackurity

Stackurity does not cover this flaw. It does not assess network appliance firmware such as firewalls and VPN gateways, so a SonicWall device will not appear in its findings, and you should rely on SonicWall's advisory and your network team for this one. Stackurity does match the exploited list against Linux servers, repositories and images, ranking each finding by exploitation, exposure and environment; see [how Stackurity ranks risk](https://stackurity.ai/docs/risk). Stackurity Cloud has a 14-day free trial without a card: [start a free trial](https://app.stackurity.dev/signup?utm%5Fsource=blog&utm%5Fmedium=referral&utm%5Fcampaign=actively-exploited&utm%5Fcontent=sonicwall-sonicos-sslvpn-cve-2026-19868-saml-mfa-bypass-exploited).