SonicWall VPN Flaw Actively Exploited: What UK Organisations Need to Do

SonicWall has released a patch for CVE-2026-19868, a vulnerability in SonicOS SSLVPN that can allow an attacker holding credentials for a different authentication method to bypass SAML checks — including SAML-enforced multi-factor authentication. SecurityWeek reports that the vulnerability is already being actively exploited in the wild, and CISA has added it to its Known Exploited Vulnerabilities catalogue, confirming real-world exploitation. The flaw is particularly significant because it undermines MFA, a control that many organisations treat as a primary — and sometimes sole — defence for remote access to their networks.

Why this matters for UK organisations

SonicWall VPN appliances are widely deployed across UK businesses and managed service providers as a remote access solution, meaning this vulnerability has direct relevance to a substantial number of organisations. The ability to bypass MFA is especially concerning because it invalidates a control that security teams and IT departments frequently rely on to protect VPN access. When MFA can be circumvented, an attacker with stolen or guessed credentials for one authentication method may be able to gain access to the network without triggering the additional verification step that would otherwise block them. The window between public disclosure and active attacker exploitation for known VPN vulnerabilities is typically very short, and with CISA confirmation of active exploitation already in place, unpatched appliances should be treated as a priority risk.

What to review

UK organisations using SonicWall SSLVPN should confirm with their IT team or managed service provider that the patch for CVE-2026-19868 has been applied as a matter of priority. It is also worth reviewing VPN authentication logs for any unusual activity in the period before patching, particularly any successful authentications that appear inconsistent with expected user behaviour or location. Organisations should also consider whether additional access controls — such as IP allowlisting, conditional access policies, or network segmentation — are in place alongside MFA, so that VPN access is not solely dependent on a single control. This incident is a useful prompt to review whether MFA is consistently enforced across all remote access routes, not just the primary VPN gateway.

Source: SecurityWeek