Search/CVE-2026-19868
● CVE — High

CVE-2026-19868

DiscoveredNov 6, 2026UpdatedNov 7, 2026

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

View graph Watch Export
CVSS v3.1
7.5 HIGH
EPSS
0.62%
probability of exploitation in 30 days
CISA KEV
Listed
confirmed active exploitation
News coverage
3
sources referencing this CVE
Related IOCs
0
seen in the same coverage
CVSS v3.1 Detail
Attack VectorNETWORK
Attack ComplexityHIGH
Privileges RequiredNONE
User InteractionNONE
ScopeCHANGED
ConfidentialityHIGH
IntegrityLOW
AvailabilityNONE
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N
Connections
5 relationships
Timeline
disclosure → media coverage
Nov 6, 2026
Disclosure — published as a CVE record.
Nov 7, 2026
bleepingcomputer.com reports: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
Nov 7, 2026
securityweek.com reports: SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins
Nov 9, 2026
thehackernews.com reports: CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
Public PoC (2)
github.com/EXEcution-py/CVE-2026-19868github.com/foxcornlab/sonicwall-sonicos-scanner
Unverified third-party code — review before executing.