SonicWall SSLVPN Flaw CVE-2026-19868 Lets Fallback Credentials Bypass SAML and MFA, CISA Lists It as Exploited
SonicWall SSLVPN flaw CVE-2026-19868 lets a user with credentials for another login method bypass SAML and its MFA. CISA added it to the exploited list on 6 November.
A SonicWall SSL-VPN set up for SAML single sign-on can be entered by anyone holding "valid credentials for an alternate authentication method", with SAML and the second factor it enforces skipped, the CVE record says. CISA added the flaw, CVE-2026-19868, to its Known Exploited Vulnerabilities catalogue on 6 November.
"SonicWall indicates that CVE-2026-19868 is being exploited," Canada's Cyber Centre says. CISA marks ransomware use as "Unknown".
Which firewalls are exposed
The CVE record lists SonicOS on Gen7 and Gen8 hardware: 7.3.3-7015 and older, and 8.2.2-8015 and older. SonicWall rates the flaw 7.1 on CVSS, BleepingComputer reports; CISA's own scoring puts it at 7.5.
What to install
SonicWall's advisory SNWLID-2026-0014 fixes the flaw in SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8; BleepingComputer and Canada's Cyber Centre carry the same fixed builds.
More news
Lam Yong Yan Deported From Vietnam, Arrested at Changi Over Phnom Penh Scam Syndicate Linked to S$53 Million in Losses
Lam Yong Yan, 27, was deported from Vietnam and arrested at Changi on 6 November over a Phnom Penh scam syndicate linked to at least 528 cases and about S$53 million in losses.
Bank Rakyat Websites Defaced by 'Marlanwg', Which Claims Access to the Bank's Internal Systems
Bank Rakyat websites were defaced late on 6 November by an attacker calling itself Marlanwg, which claims internal access. The Malaysian bank has confirmed only an access problem.
M1 Data Breach Exposes Customers' NRIC Numbers, Addresses and Phone Numbers
M1 data breach: the Singapore telco says customer names, NRIC/FIN numbers, birth dates, phone numbers and addresses were exposed on 30 October. Payment data was not, it says.