Critical SonicWall SonicOS SSLVPN Flaw Allows SAML and MFA Bypass

Key points

• CVE-2026-19868 affects SonicWall SonicOS SSLVPN authentication.
• SAML and MFA controls can be bypassed; single-factor setups are especially weak.
• Apply vendor mitigations now and inventory internet-facing SSLVPN endpoints.
• If no fix is available, retire or disable the exposed service.

A critical authentication flaw tracked as CVE-2026-19868 affects SonicWall's SonicOS SSLVPN component. The weakness can allow an attacker to get around SAML-based sign-in and multifactor authentication checks, and it is particularly dangerous where single-factor authentication is still in use. Because SSLVPN gateways are often published directly to the internet, this is not a theoretical risk for organizations that rely on them for remote access.

The exposure is broadest for K-12 districts, government agencies, and other organizations that use SonicWall SSLVPN to connect staff or contractors to internal systems. Any instance reachable from the public internet should be treated as potentially vulnerable until it has been reviewed and mitigated. The flaw matters because authentication is the primary control protecting remote access; if SAML and MFA can be circumvented, downstream controls may not stop an intruder from reaching internal resources.

SonicWall has provided mitigations, and administrators should apply them without waiting for a full maintenance window if possible. At the same time, teams should determine which SSLVPN services are exposed externally and whether each one is still operationally necessary. Reducing the internet-facing footprint limits opportunity for abuse and makes monitoring more effective.

Where no fix or workable mitigation exists, the safest course is to stop using the affected SSLVPN service rather than leave it exposed. Organizations should also review authentication logs for unexpected SAML activity, MFA bypass behavior, or unusual remote sessions, and confirm that single-factor fallback paths are not silently enabled. Watch for updated vendor guidance, revised CVE details, and any signs of attempted exploitation against exposed gateways.

What to do now

1. Inventory every SonicWall SonicOS SSLVPN instance and identify which ones are reachable from the public internet.
2. Apply SonicWall's mitigations or updates immediately, following vendor guidance for CVE-2026-19868.
3. Restrict SSLVPN access to trusted source ranges or require an additional access layer where feasible.
4. Review authentication and VPN logs for anomalous SAML assertions, MFA bypass events, and unexpected sessions.
5. Disable single-factor authentication paths and confirm that fallback methods cannot weaken MFA enforcement.
6. If no fix or mitigation is available, disable the SSLVPN service or retire the exposed appliance.
7. Reassess external exposure after mitigation and remove any SSLVPN service that is no longer required.

Original source

CISA Known Exploited Vulnerabilities