SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
SonicWall — SonicOS SSLVPN
- Added to KEV catalog
- 6 November 2026
- Federal remediation due date
- 20 November 2026
- Weakness classification (CWE)
- CWE-308
AI Breakdown
What it is
SonicWall SonicOS SSLVPN contains a flaw where single-factor authentication is improperly accepted in place of stronger controls. An attacker with valid credentials for an alternate login method can exploit this flaw to bypass SAML authentication entirely. This bypass also circumvents SAML-enforced multi-factor authentication, allowing unauthorized access to the network.
Why it matters
This vulnerability is catalogued as actively exploited in the wild, making it an urgent operational risk for organizations relying on SonicWall SSLVPNs. Bypassing multi-factor authentication leaves network perimeters exposed to unauthorized entry and potential lateral movement. While confirmed ransomware campaign links are currently unknown, active exploitation demands immediate defensive response.
Recommended action
Evaluate all internet-exposed SonicWall assets and apply vendor mitigations in accordance with official instructions and CISA BOD 26-04 guidelines. Conduct forensic triage on affected devices as required by CISA to determine if any unauthorized access has already occurred. If mitigations are unavailable, follow applicable guidance or discontinue use of the product to prevent compromise.
AI-generated from CISA and NVD data — treat as a starting point, not a substitute for your own risk assessment.
CISA Description
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Required action
Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes). Follow applicable BOD 26-04 guidance for cloud services or discontinue use of the product if mitigations are unavailable. Stakeholders are responsible for evaluating each asset's internet exposure and ensuring adherence to BOD 26-04 patching guidelines.
Notes
https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014 ; BOD 26-04: https://www.cisa.gov/news-events/directives/bod-26-04-prioritizing-security-updates-based-risk ; Forensics Triage Requirements: https://www.cisa.gov/news-events/directives/bod-26-04-implementation-guidance-prioritizing-security-updates-based-risk ; https://nvd.nist.gov/vuln/detail/CVE-2026-19868
More SonicWall Vulnerabilities
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall SMA1000 Appliances OS Command Injection Vulnerability
SonicWall SMA1000 Appliances Code Injection Vulnerability
SonicWall SMA1000 Appliances Server-Side Request Forgery Vulnerability
SonicWall SMA1000 Missing Authorization Vulnerability
Is this vulnerability present in your environment?
CRS delivers independent VAPT assessments that identify exactly which known-exploited vulnerabilities exist in your network, applications, and infrastructure.
Explore VAPT Services