Osegi
Security·2 min read

SonicWall VPN flaw CVE-2026-19868 bypasses two-factor login

A SonicOS flaw already exploited by attackers lets anyone with valid credentials skip two-factor checks on SonicWall SSL VPNs. Consumer VPNs are not affected.

A SonicWall firewall appliance in a server rack with a padlock icon symbolizing a VPN authentication bypass.
Image: 01net.com
SUMODialoediviewergiftdetect

A vulnerability in SonicWall firewalls, already exploited in the wild, allows attackers to open a corporate VPN session without passing two-factor authentication. Despite the alarming headline, it does not affect consumer VPN apps or home internet routers.

Tracked as CVE-2026-19868, the bug sits in the SSL VPN service of SonicOS, the operating system of SonicWall firewalls. The vendor disclosed it on 6 November in a security bulletin and rated it 7.1 out of 10. Many companies force logins through SAML, a single sign-on system that triggers two-factor checks. With valid credentials for another login method, an attacker can skip that step, so a password alone opens a session. It is a logic error in how the firewall verifies access, not a break of encryption.

Who is affected

The scope is narrow. Affected are generation 7 firewalls (TZ, NSa, NSsp and NSv) running SonicOS 7.3.3-7015 or earlier, and generation 8 devices (TZ, NSa and NSv) on 8.2.2-8015 or earlier, but only if SAML login is enabled for the SSL VPN. Employees can be exposed indirectly: if their company uses such a setup, their work credentials become the key to the network.

SonicWall says it investigated a report of possible exploitation but gave no details. The US cybersecurity agency CISA added the flaw to its catalog of actively exploited vulnerabilities on the day of publication, giving federal agencies until 20 November, or 14 days, to patch. The catalog now lists 20 SonicWall flaws. Neither the company nor CISA has said how many organizations were targeted, or whether attacks began before the fix.

What to do

There is no workaround. The only remedy is updating to SonicOS 7.3.4-7013 or later on generation 7, or 8.2.3-8015 or later on generation 8. The same release fixes six other flaws, including two rated 8.8 out of 10 in the admin interface.

An update does not reveal whether someone already got in. IT teams should compare VPN sessions logged by the firewall with those validated by their identity provider: a session with no matching SAML login is a red flag.

Attackers need valid credentials first, usually stolen through phishing or data leaks. Employees should avoid reusing work passwords, distrust login pages received by email, and report any unexpected two-factor prompt to IT.

Apps worth a look

SUMO: the number puzzle

Tap the right tiles, add them up, hit the target. Easy to learn, hard to master. Free, for all ages.

Tags:sonicwallsonicosvpncve-2026-19868cisatwo-factor authentication

More from this day

See all →

More in: Security

See all →