Attackers are exploiting a flaw in the SSL VPN service of SonicWall's SonicOS firewalls that can let someone get past SAML sign-in, and with it the multi-factor authentication (MFA) that many organizations enforce through SAML. The US Cybersecurity and Infrastructure Security Agency (CISA) added the bug, tracked as CVE-2026-19868, to its Known Exploited Vulnerabilities catalog on November 6, 2026, which means it has evidence of exploitation in the wild.
The listing landed on the same day the CVE record itself went public in the National Vulnerability Database. Defenders who wait for a vendor blog post or a researcher write-up before acting are already behind.
A sign-in rule that can be sidestepped
SAML is the standard many companies use to hand VPN logins off to a central identity provider, which is usually where the MFA prompt lives. According to the CVE description, a user who holds valid credentials for an alternate authentication method on the SSL VPN may be able to bypass the SAML authentication controls, and successful exploitation may also bypass SAML-enforced MFA. CISA classifies it as a use of single-factor authentication weakness (CWE-308).
Note what that wording does and does not say. The attacker needs working credentials of some kind; this is not described as a login-free bug. What it removes is the second gate that a SAML-plus-MFA setup is meant to add. Neither the CVE description nor CISA's entry explains which alternate methods are involved or how the bypass is carried out, and the vendor advisory is the place for that detail.
The NVD record carries a CVSS v3.1 base score of 7.5 (High), with network attack vector and high attack complexity. CISA's catalog lists known ransomware campaign use as unknown, and neither source names who is behind the exploitation.
Why a SonicWall VPN keeps drawing fire
Edge VPN appliances are a favorite first step into corporate networks, and SonicWall gear has been a steady target this year. Its separate SMA1000 remote-access line has seen its own flaws exploited and, in October, a third login-free SMA1000 bug patched. CVE-2026-19868 is a different product, the SonicOS firewall operating system, but the pattern is the same: the box that is supposed to check who you are becomes the way in.
Act on SonicWall's SNWLID-2026-0014 by November 20
SonicWall's advisory, SNWLID-2026-0014, carries the affected versions and remediation. CISA's required action is to apply mitigations in line with the vendor's instructions, or stop using the product if no mitigation is available. Federal civilian agencies must do so by November 20, 2026 under Binding Operational Directive 26-04; every other SonicOS SSL VPN operator should treat that date as a ceiling, not a target.
- Read SNWLID-2026-0014 and apply whatever update or mitigation it specifies on every firewall exposing SSL VPN.
- Check which authentication methods are still enabled on the SSL VPN alongside SAML, and disable any that are not needed.
- Review recent SSL VPN sessions for logins that did not pass through your identity provider, and reset credentials for any account that shows one.
An MFA prompt is only as strong as the device that decides whether to show it. Until the vendor's fix is in place, assume that on an exposed SonicOS SSL VPN, a stolen password may be enough.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.