What happened
CISA listed CVE‑2026‑19868 in its Known Exploited Vulnerabilities catalog. The flaw resides in SonicWall SonicOS SSLVPN and allows a user who holds valid credentials for an alternate authentication method to bypass SAML authentication, including SAML‑enforced MFA. SonicWall’s PSIRT confirmed a report of possible exploitation and recommends immediate firmware updates. The issue does not require unauthenticated access, but once valid alternate credentials are present, the attacker can gain VPN access without completing the intended MFA step.
Why it matters for trust and compliance
- The vulnerability tests the access‑control objective of enforcing authentication and MFA, a control that maps to many frameworks such as NIST CSF 2.0. Failure to enforce SAML‑MFA weakens the evidential chain needed for audit readiness.
- Validate that SAML authentication enforcement cannot be bypassed for VPN users.
- Implement continuous monitoring and alerting on VPN login and MFA events to provide defensible audit evidence.
Who is affected
TECH_SAAS
Recommended actions
- Apply the latest SonicWall SonicOS firmware that patches CVE‑2026‑19868.
- Review and harden SAML and MFA configurations for all SSLVPN users.
- Enable detailed logging of VPN authentication attempts and integrate with a SIEM for real‑time monitoring.
Details
- CVEs
- CVE-2026-19868