CVE-2026-19868: SonicWall SonicOS SSLVPN Single‑Factor Authentication Bypass Vulnerability
What It Is — SonicWall’s SonicOS SSLVPN implementation contains a single‑factor authentication flaw (CVE‑2026‑19868) that can be abused to bypass SAML authentication controls. An attacker who possesses valid credentials for any alternate authentication method can sidestep the SAML‑enforced multi‑factor authentication (MFA) flow, gaining VPN access without completing the required second factor. The vulnerability is publicly listed in the CISA Known Exploited Vulnerabilities (KEV) catalog, carries a CVSS v3.1 base score of 9.8 (Critical), and is exploitable remotely without prior access. No vendor‑issued patch was available at the time of the advisory; SonicWall recommends immediate mitigation through network‑level restrictions and MFA policy hardening.
Affected Products — SonicWall SonicOS SSLVPN (all released versions prior to the forthcoming security update).
Why It Matters for Trust & Control Assurance — The flaw directly challenges the control objective of enforcing multi‑factor authentication for privileged remote access, a cornerstone of many compliance frameworks.
Recommended Actions
- Verify the current SonicOS version and apply any vendor‑released patches immediately.
- Enforce MFA at the identity‑provider level and disable any legacy authentication methods that could be leveraged for bypass.
- Enable and centralise SSLVPN authentication logs; monitor for anomalous log‑ins that succeed without MFA.
- Conduct a rapid control‑gap assessment against your MFA policy and document remediation evidence.
Source: CISA KEV – CVE‑2026‑19868