The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added a critical vulnerability affecting SonicWall SonicOS SSLVPN to its Known Exploited Vulnerabilities (KEV) catalog. The flaw, identified as CVE-2026-19868, carries a CVSS score of 7.5 and pertains to an authentication enforcement issue within the SSL VPN service.
According to technical documentation, the vulnerability stems from a failure in the system to properly enforce Security Assertion Markup Language (SAML) authentication controls. This oversight allows an attacker who already possesses valid credentials for an alternative authentication method to circumvent the intended SAML authentication process.
Because the flaw specifically impacts the enforcement of SAML controls, it poses a heightened risk to organizations that rely on this protocol to mandate multi-factor authentication (MFA). By exploiting this weakness, an unauthorized actor can gain access to the SSL VPN while successfully bypassing the additional layer of security provided by MFA.
It is important to note that this is not an unauthenticated remote access vulnerability. An attacker must first be in possession of valid credentials for a secondary authentication method to initiate the bypass. Once those credentials are used, the system fails to verify the SAML-based requirements, granting the attacker unauthorized access to the environment.
SonicWall’s Product Security Incident Response Team (PSIRT) has confirmed that they are investigating reports indicating that this vulnerability has been subject to potential exploitation in the wild. In response, the company has strongly urged all customers to apply the latest available software updates immediately to mitigate the risk of compromise.
Under the requirements of Binding Operational Directive 22-01, federal civilian executive branch (FCEB) agencies are mandated to address this vulnerability by November 20, 2026. While this directive applies specifically to federal agencies, cybersecurity experts strongly advise private sector organizations to review the KEV catalog and prioritize patching their infrastructure to defend against potential exploitation.
