[Security](https://leakly.com/security/)

[Confirmed]

# SonicWall warns an SSL-VPN MFA bypass flaw has been exploited

CVE-2026-19868 affects SonicOS SSL-VPN set up with SAML authentication.

Leaked on 07 November 2026

![Screenshot of @BleepinComputer's X post: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks](https://leakly.com/assets/images/sonicwall-ssl-vpn-mfa-bypass-exploited-hero.jpg)

@BleepinComputer's post on X, with counts as of 09 Nov 2026 12:49 UTC. [Live post on X](https://x.com/BleepinComputer/status/2118856246228820028)

SonicWall released updates for seven SonicOS vulnerabilities, including an SSL-VPN authentication bypass flaw exploited in attacks, [BleepingComputer](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/) (@BleepinComputer) reported on November 7.

> **BleepingComputer** @BleepinComputer
>
> SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
> https://t.co/iAu4SrqQwm
> https://t.co/iAu4SrqQwm
>
> 53 likes · 14 reposts · counts as of 09 Nov 2026, 12:49 UTC
>
> — BleepingComputer (@BleepinComputer) [November 7, 2026](https://twitter.com/BleepinComputer/status/2118856246228820028)

not in our leaker index

The flaw, CVE-2026-19868, lets attackers with valid credentials for an alternate authentication method bypass SAML controls, potentially including SAML-enforced MFA. It has a CVSS score of 7.1, according to BleepingComputer.

SonicWall confirmed a report of potential exploitation and urged customers to upgrade.

## What we know

* CVE-2026-19868 has a CVSS score of 7.1.
* SonicWall reports potential exploitation.

## What we don't know

* How many devices were attacked.

## What would confirm it

Already confirmed by SonicWall.

## Sources

* [Original X post by @BleepinComputer](https://x.com/BleepinComputer/status/2118856246228820028)
* [SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/)

[Confirmed]

## What happened later

SonicWall confirmed a report of potential exploitation and urged customers to upgrade.

Status key: [how we label leaks](https://leakly.com/editorial-guidelines/#status) · [Corrections](https://leakly.com/corrections/) · [Contact](https://leakly.com/contact/)