Security ·
SonicWall CVE-2026-19868: SSL VPN flaw bypasses SAML login and CISA flags it as exploited
On 6 November 2026 the US agency CISA added CVE-2026-19868 in the SSL VPN of SonicWall firewalls running SonicOS to its catalog of exploited vulnerabilities. An attacker holding valid credentials for another login method can bypass SAML and the multi-factor check behind it.
On 6 November 2026 CISA added CVE-2026-19868 in the SSL VPN service of SonicWall's SonicOS to its Known Exploited Vulnerabilities (KEV) catalog. CISA named it a use of single-factor authentication. According to security media, it is a weakness in how login is enforced: someone who holds valid credentials for an alternate login method can skip the SAML check, and with it the multi-factor authentication that sits behind SAML.
The problem only affects deployments where SSL VPN logins go through SAML. Reports say it hits SonicOS 7.3.3-7015 and older and 8.2.2-8015 and older, with fixes in builds 7.3.4-7013 and 8.2.3-8015. SonicWall described the flaw in advisory SNWLID-2026-0014 of 6 November. Media report that there is no workaround other than upgrading. A CVSS score of 7.1 is quoted. CISA gave US federal agencies until 20 November 2026 to deal with it.
The question most readers ask is whether this concerns companies in Czechia. It does, if you run a SonicWall firewall with SSL VPN and SAML login, for example tied to Microsoft Entra ID or another identity provider. The attacker does need valid credentials for some other login method, so the biggest exposure is in companies that left older local accounts or other methods enabled next to SAML.
KEV listing means the flaw is exploited in the wild. Sources differ on details, such as the exact fixed build numbers and, on one auto-generated page, whether exploitation is happening at all, so check the version numbers against SonicWall's own advisory. A separate flaw on the same platform, CVE-2026-82308, a heap overflow in SSL VPN, is unrelated to this case but is one more reason to keep firmware current.
What it means for companies
If you run SonicWall with SSL VPN, check your SonicOS version today, install a fixed build and switch off every alternate login method you do not need. After updating, review the login logs of the past weeks for sign-ins that skipped SAML. We review VPNs, firewalls and access as cyber security, and routine patching of sites and servers is part of website maintenance. Watching CISA and NÚKIB alerts and flagging unusual logins can be handled by an AI agent that leaves the decision to a human. Prahapp, the AI division of Buinsoft Technology in Prague, builds a free prototype within 3 working days.
Sources: CISA: Adds One Known Exploited Vulnerability to Catalog (6 Nov 2026), GBHackers: Hackers exploit SonicWall SSL-VPN vulnerability to bypass MFA