SonicWall has released security updates for a SonicOS SSLVPN vulnerability that is being exploited in attacks. Tracked as CVE-2026-19868, the flaw concerns enforcement of authentication controls, rather than a general failure of VPN encryption.
An attacker needs valid credentials for an alternative authentication method. Under the affected conditions, those credentials can be used to bypass SAML authentication controls, potentially including the multi-factor authentication enforced through SAML. This is not a claim that any anonymous internet user can bypass every SonicWall login.
A second path into the system
SAML is used to connect a service’s sign-in process with an organisation’s identity provider. The risk here is that an alternative authentication route can undermine the policy the organisation expects the SAML route to enforce. A configured security control is only useful if every relevant access path respects it.
The Canadian Centre for Cyber Security issued an advisory on 6 November and confirmed the vulnerability’s addition to the US CISA catalogue of known exploited vulnerabilities. That moves the issue beyond a theoretical weakness: administrators have a concrete reason to prioritise review of exposed systems.
Check the appliance, not just the policy
Organisations using SonicOS SSLVPN should compare their appliance generation and installed firmware with the vendor advisory, then deploy the appropriate fixed release. Different product branches require different builds; a version number from another branch should not be treated as proof of protection.
The disclosure also makes alternative login methods and access permissions relevant to incident review. Installing a fix closes the documented software weakness, but does not by itself establish whether an earlier intrusion occurred. That question depends on the organisation’s own logs and investigation. The advisory is not evidence that Nove.news or any other named website has been compromised.
