SonicWall SSLVPN flaw CVE-2026-19868 is exploited and in CISA KEV: patch exposed gateways now

SonicWall SSLVPN CVE-2026-19868 is exploited and in CISA KEV. Patch exposed gateways, restrict access, and review SAML/MFA logs now.

  • CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN flaw, to its Known Exploited Vulnerabilities catalog after evidence of exploitation.
  • The bug can let an attacker who already holds credentials for a different login method bypass SAML checks, including SAML-enforced MFA, on affected VPN paths.
  • Any school or government team exposing SonicWall SSLVPN to the internet should treat this as emergency patching, restrict access, and review VPN/SAML logs for skipped MFA or unusual sessions.

What to do now

  1. Inventory every SonicWall SonicOS device that terminates SSLVPN or participates in SAML authentication; record model, SonicOS version, owner, exposure, and business need.
  2. Apply the vendor fixed SonicOS release or documented mitigation immediately for internet-facing SSLVPN instances, using emergency change approval and covering HA pairs and remote sites.
  3. If patching cannot happen now, restrict SSLVPN and management access by source IP, disable unused portals, or temporarily turn off SSLVPN where operationally feasible.
  4. Review VPN, SAML, and authentication logs for successful logins that skipped MFA prompts, used unexpected assertions, came from new locations, or had unusual session lengths; preserve evidence and revoke suspicious sessions.
  5. After patching, test SAML validation and MFA enforcement with representative accounts, feed edge logs to the SIEM with authentication-anomaly alerts, and monitor SonicWall advisories plus the CISA KEV entry until closure.

Related items