CISA Adds CVE-2026-19868 for SonicWall SSLVPN Authentication Bypass

## Overview CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog. This vulnerability affects SonicWall's SonicOS SSLVPN. It allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls. This inclusion signals a federal deadline for remediation efforts. ## Technical Details The vulnerability stems from the use of single-factor authentication within the SonicOS SSLVPN service. Attackers can exploit this flaw to bypass SAML-enforced multi-factor authentication (MFA). The CVSS score of 7.5 indicates a high severity level. Evidence of exploitation has been observed, prompting CISA's action to add it to the KEV list. ## Impact Successful exploitation of this vulnerability can lead to unauthorized access to systems protected by SAML authentication. This can compromise sensitive data and allow attackers to perform actions as legitimate users. Organizations relying on SonicWall SSLVPN should be particularly vigilant, as the risk of an attack increases with the availability of exploitation methods. ## Mitigation Defenders should immediately enforce multi-factor authentication across all access points. SonicWall recommends updating to the latest version of SonicOS that addresses this vulnerability. Regularly review authentication methods and ensure that single-factor authentication is not the only line of defense. Organizations should also monitor for unusual access patterns and implement logging to detect potential exploitation attempts.