Patch Forecast
Amber warning
Patch this week. CISA deadline for US federal agencies: 20 Nov 2026.

CVE-2026-19868 Exploited in the wild

SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

Risk score
78/100
CVSS
Not Scored
Published
6 Nov 2026
Added to CISA's exploited list
6 Nov 2026

Open in the live forecast Today's forecast

What to know

What it is
A vulnerability in SonicOS SSLVPN service allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially bypassing multi-factor authentication. An attacker could exploit this to gain unauthorized access.
Affected
{'products': ['SonicOS SSLVPN'], 'packages': [], 'versions': []}
Fix
Apply mitigations in accordance with vendor instructions
Exploitation
Exploited in the wild

Story map

Story map: Sonicwall Sonicos SslvpnTHE FLAWSTHE FIXCVE-2026-19868SonicWall SonicOS SSLVPN Useof Single-factorAuthentication VulnerabilityexploitedFixApply mitigations in accordancewith vendor instructionsWho is exposed{'products': ['SonicOSSSLVPN'], 'packages': [],'versions': []}AMBER · PATCH THIS WEEKSonicwall SonicosSslvpnA vulnerability in SonicOSSSLVPN service allows userswith valid credentials for analternate authentication methodto bypass SAML authenticationcontrols, potentially bypassingmulti-factor authentication. An…Where it standsExploited in the wildOn CISA's exploited list since 6 NovUS federal deadline 20 NovHOW IT UNFOLDEDOfficial record on the left, the press on the right, oldest first.6 Nov · CISAAdded to the Known Exploited Vulnerabilities list6 Nov · CISA advisories (US)CISA Adds One Known Exploited Vulnerability toCatalog20 Nov · Deadline · to comeUS federal agencies must have patched by thenCONNECTS TOSame weaknessCWE-308 (CWE-308)4 other warnings in 30 days →
Story map: the flaws, the fix, how it unfolded and what it connects to. Boxes link to the record or article.

At a glance

Sonicwall Sonicos Sslvpn: Amber, patch this week. A vulnerability in SonicOS SSLVPN service allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially bypassing multi-factor authentication. An attacker could exploit this to gain unauthorized access.

The flaws

  • CVE-2026-19868: SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability (exploited)

The fix

Fix: Apply mitigations in accordance with vendor instructions

Who is exposed: {'products': ['SonicOS SSLVPN'], 'packages': [], 'versions': []}

Where it stands

  • Exploited in the wild
  • On CISA's exploited list since 6 Nov
  • US federal deadline 20 Nov

How it unfolded

  1. 6 Nov, CISA (official): Added to the Known Exploited Vulnerabilities list
  2. 6 Nov, CISA advisories (US) (official): CISA Adds One Known Exploited Vulnerability to Catalog
  3. 20 Nov, Deadline (official): US federal agencies must have patched by then

Connects to

Why it is Amber

  • Not yet scored by NVD
  • Exploited in the wild (CISA KEV)
  • Named in a government or vendor bulletin

CISA required action

Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.

Government and vendor bulletins

References

Original description

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

Last activity 6 Nov 2026. Patch Forecast updates every hour.