[CVE-2026-19868] SonicWall SonicOS SSLVPN — SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability

What happened?

SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). Required action: Apply mitigations in accordance with vendor instructions, ensuring compliance with CISA’s BOD 26-04 Prioritizing Security Updates Based on Risk (see URL in Notes) guidance and CISA’s “Forensics Triage Requirements” (see URL in Notes).

Key details

• A missing variable initialization in the Linux kernel allows unintended modification of page-cache-backed data.
• The flaw occurs when the shared-fragment marker is not preserved during socket buffer coalescing.
• ESP input processing decrypts shared fragments in place as a result of the flaw.
• This vulnerability can be chained with CVE-2026-109618 and CVE-2026-109619 to implant PHP webshells and run commands as root.
• Forensic triage is required per BOD 26-04 for affected systems.

Summarised by SecOraLens from CISA KEV. Always read the original source before acting. How SecOraLens verifies advisories.