Actively exploited SonicWall VPN flaw can bypass MFA: secure SonicOS SSLVPN now

CVE-2026-19868 · SonicWall SonicOS SSLVPN · added to the CISA Known Exploited Vulnerabilities catalog on November 6, 2026

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a SonicWall vulnerability, CVE-2026-19868, to its list of flaws that attackers are already using. It affects the SSL VPN feature in SonicWall SonicOS, which many small offices use to let staff work remotely.

What happened

The flaw lets someone who has a valid username and password for a different login method get around the SAML sign-in your VPN is supposed to require. That can also mean skipping multi-factor authentication (MFA) that is enforced through SAML. In plain terms: a stolen or leaked password may be enough to get into your network, even if you thought MFA was protecting you. There are no public reports so far of ransomware gangs using this flaw, but VPN access is a common first step in ransomware attacks.

Who is affected

Businesses with a SonicWall firewall running SonicOS with SSL VPN enabled, especially those using SAML (for example, Microsoft 365 or Google sign-in) with MFA for VPN logins.

What to do now

• Apply SonicWall's fixes or mitigations from its security advisory for this issue as soon as possible.
• Review which VPN login methods are turned on and disable any you do not need, such as old local accounts.
• Reset passwords for VPN users, particularly any accounts that may have been reused elsewhere or exposed.
• Check VPN logs for logins at odd hours, from unfamiliar locations or from accounts that should not be in use.
• If you are not sure how your VPN is set up, contact your IT provider today.

RedCube IT Services is already checking and patching SonicWall devices for our managed clients. If you are not a client and want to know whether your firewall or VPN is exposed, contact us for a free security check.