Actively exploited in the wild
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall - SonicOS SSLVPN · Listed in the CISA KEV since 2026-11-06. This indicates confirmed attacks in production environments.
Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
CVE-2026-19868
UnknownKEVSummary
An authentication enforcement vulnerability in the SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Risk Assessment
An attacker with valid credentials could gain access to protected resources while bypassing SAML and MFA, weakening the organization's strong authentication policy. This poses a risk of unauthorized VPN access.
Recommendation
Update SonicOS to a version containing the fix for this vulnerability and verify SAML and MFA configuration. Until patched, restrict access to the SSLVPN service.
Other vulnerabilities in SonicOS
See all- CVE-2026-82308Unknown
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS SSL-VPN service. It could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77709Unknown
A pre-authentication heap-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-77708Unknown
A pre-authentication stack-based buffer overflow vulnerability was identified in the SonicOS TACACS+ authentication client. Under specific conditions it could allow a remote unauthenticated attacker to cause an application-level denial of service.
- CVE-2026-19703Unknown
A weak password hashing vulnerability has been identified on SonicOS virtual appliances. Under specific conditions, an attacker with existing local access could disclose a platform credential that grants access to a limited subset of platform settings.
- CVE-2026-107155High
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface. Under specific conditions it could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- CVE-2026-107154High
A session validation vulnerability has been identified in the SonicOS management interface. Under specific conditions it could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- CVE-2020-5135CriticalActively exploited
A buffer overflow vulnerability in SonicOS allows a remote attacker to cause a Denial of Service (DoS) and potentially execute arbitrary code by sending a malicious request to the firewall. It affects SonicOS Gen 6 versions 6.5.4.7, 6.5.1.12, 6.0.5.3, SonicOSv 6.5.4.v and Gen 7 version 7.0.0.0.
- CVE-2026-0516Medium
SonicOS contains a vulnerability related to improper neutralization of HTTP headers for scripting syntax. A remote attacker can manipulate the Host header and redirect firewall management users to arbitrary web domains.
- CVE-2026-0206Medium
A post-authentication stack-based buffer overflow vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2026-0205Medium
A post-authentication path traversal vulnerability in SonicOS allows an attacker to interact with usually restricted services. The attacker must be authenticated to exploit this flaw.
Original NVD description (English source)
An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Vulnerability data from NVD (NIST) · CISA KEV · EPSS