Weekly Security Brief: SonicWall SSLVPN Flaw Lets Users Skip SAML MFA

The US Cybersecurity and Infrastructure Security Agency added one actively exploited vulnerability to its Known Exploited Vulnerabilities catalog on November 6, 2026. The flaw affects SonicWall SonicOS SSLVPN. It can let someone with a working password for a secondary sign-in method get around SAML login controls, including multi-factor authentication enforced through SAML.

The deadlines in the catalog are binding only for US federal civilian agencies. For other organizations, they are a useful benchmark for how quickly to act on a flaw that attackers are already using.

SonicWall SonicOS SSLVPN: How the SAML Bypass Works

Many organizations put SAML in front of their SonicWall SSL VPN. SAML hands the login to an outside identity provider, which often requires a second factor such as an app prompt or a hardware key. The point is that every remote user has to pass through that stronger check.

CVE-2026-19868 undermines that arrangement. A person who holds valid credentials for a different authentication method configured on the appliance can use them to get past the SAML requirement. If SAML is how the organization enforces MFA, the second factor can be skipped as well, leaving a single password as the only barrier to VPN access.

The flaw does not let a stranger in with no credentials at all. The attacker needs a working username and password for the alternate method. Stolen, reused or leaked passwords are therefore the main concern, because they become far more dangerous when the MFA layer can be avoided.

Who Should Act on CVE-2026-19868

Any business that runs SonicWall firewalls with SSL VPN enabled and relies on SAML for remote sign-in should treat this as urgent. That includes small offices that set up SAML specifically to add MFA to remote access, since that protection is exactly what the flaw can bypass.

CISA lists known use in ransomware campaigns as “Unknown.” That means the agency has not confirmed a link, not that one has been ruled out. Remote access devices are a common entry point for intruders, so the lack of a confirmed ransomware tie is no reason to wait.

CISA’s required action is to apply mitigations according to SonicWall’s instructions. Federal agencies must also follow the agency’s BOD 26-04, titled “Prioritizing Security Updates Based on Risk,” and its “Forensics Triage Requirements.” Agencies using cloud services are directed to the applicable BOD 26-04 guidance. If no mitigation is available, CISA says to stop using the product. For everyone else, the practical step is the same: apply the vendor’s update or mitigation as soon as possible.

What to Do This Week

• Identify every SonicWall device running SonicOS with SSL VPN enabled, and note which ones use SAML for sign-in.
• Apply SonicWall’s update or mitigation for CVE-2026-19868, aiming to finish before the November 20, 2026, federal deadline.
• Review which alternate authentication methods, such as local accounts, are still configured on the VPN, and remove any that are not needed.
• Check VPN login records for sessions that did not pass through your SAML identity provider, and reset passwords for any accounts involved.
• If a fix cannot be applied, follow CISA’s direction to stop using the product until one is available.

FAQ

– Does an attacker need a password to exploit this flaw?

Yes. The weakness requires valid credentials for an alternate authentication method on the device. It removes the SAML and MFA checks, not the need for a working password.

– Is the November 20 deadline mandatory for my business?

No. The date binds US federal civilian agencies only. Because the flaw is already being exploited, it is a sensible target date for any organization using the affected product.

– Has this vulnerability been tied to ransomware?

CISA lists ransomware use as “Unknown.” The agency has not confirmed that ransomware groups are using it.