SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability tracked as CVE-2026-19868. The flaw allows a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation can also bypass SAML-enforced multi-factor authentication (MFA), significantly weakening access controls. The vulnerability is catalogued by CISA and covered under BOD 26-04, which prioritizes security updates based on risk. SonicWall has published an advisory via their PSIRT portal under SNWLID-2026-0014. CISA has also published forensics triage requirements related to this vulnerability. Federal agencies and organizations using SonicWall SSLVPN with SAML-based MFA are particularly at risk. Immediate patching and review of authentication configurations are strongly recommended.