SonicWall Warns of SonicOS Flaw Allowing SAML MFA Bypass in SSL-VPN

SonicWall has issued a security advisory for a vulnerability in its SonicOS operating system that powers the company's firewalls. The flaw, tracked as CVE-2026-19868, enables attackers who already possess valid SSL-VPN credentials to circumvent SAML authentication controls and the multi-factor authentication enforced by SAML. The company released patches to address the issue and stated it investigated a report indicating possible exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has also confirmed active abuse of the vulnerability. No technical details about the attacks or their timeline have been disclosed. SonicWall urges customers to apply the updates immediately due to the associated risks.

Security.NLNovember 7, 2026Translated from NL

Read at source

SonicWall has warned customers about a vulnerability in SonicOS, the operating system running on its firewalls, that allows attackers to bypass SAML-enforced multi-factor authentication on SSL-VPN connections.

The issue is tracked as CVE-2026-19868. An attacker with valid SSL-VPN login credentials can circumvent the SAML authentication controls and the MFA that SAML enforces. SAML stands for Security Assertion Markup Language, a standard used to exchange authentication and authorization data between domains.

SonicWall said it investigated a report suggesting possible exploitation of the flaw. The company has released updates to resolve the problem and strongly recommends that customers install the patches as soon as possible because of the associated risks.

The U.S. cyber agency CISA has also noted active abuse of the vulnerability. No further details regarding the attacks or when they began have been provided.

SonicWall CISA SAML SonicOS CVE-2026-19868

ShareX Facebook LinkedIn Reddit

Meridian digestThe week's most consequential security stories, distilled into one briefing.See the digest

More in Vulns & Exploits

Vulns & Exploits

Microsoft Releases New Windows Paint Version to Address Critical RCE Vulnerability CVE-2026-83844

Microsoft has issued an updated version of Windows Paint to resolve a serious remote code execution vulnerability identified as CVE-2026-83844. The flaw allows an unauthenticated attacker to execute arbitrary code on vulnerable systems by sending a specially crafted packet, with no user interaction required. The vulnerability was first addressed in a security update on 13 October, but gained wider attention this week after system administrators on Reddit reported difficulties obtaining the patch. The National Cyber Security Centrum (NCSC) warned that successful exploitation could enable attackers to install programs, view data, or fully compromise affected systems. Microsoft now recommends that users upgrade to Windows Paint version 11.2609.401.0 or verify that the version has been installed automatically. The company updated its security bulletin for CVE-2026-83844 yesterday evening to confirm the new release fully mitigates the issue.

Security.NLNov 7, 2026Translated from NL

Vulns & Exploits

QNAP Warns Plex Users of Active Plex2Shell Exploitation on NAS Devices

QNAP has issued an urgent advisory to users running Plex Media Server on their NAS systems regarding a set of four vulnerabilities collectively known as Plex2Shell. The flaws allow unauthenticated remote attackers to take full control of vulnerable Plex instances. Plex has confirmed that the vulnerabilities are being actively exploited on a large scale following the public release of proof-of-concept code on 16 October. Compromised servers are being infected with cryptominers and proxy software that enables further malicious activity from the affected systems. QNAP recommends immediate installation of Plex version 1.43.3.10861 or newer through the App Center and advises additional hardening steps for internet-exposed deployments.

Security.NLNov 6, 2026Translated from NL

Vulns & Exploits

Attackers Exploit OpenSSH 'SSHole' Flaw on musl Systems to Deploy Botnets and Cryptominers

Cybersecurity firms have reported active exploitation of a vulnerability in OpenSSH affecting systems that use the musl library, including Alpine Linux, OpenWRT, Buildroot, and Yocto. The flaw, nicknamed 'SSHole', allows attackers to bypass authentication on accounts configured with no password by supplying a password longer than 256 characters. The issue occurs when OpenSSH runs on musl without PAM, with password authentication enabled and specific account configurations present. OpenSSH 10.6p2 was released on November 5, 2026, with a mitigation after the vulnerability was disclosed on November 4. Initial attacks began within nine hours of the patch release, with observed activity limited to botnet recruitment and cryptominer installation. The Dutch NCSC recommends restricting SSH exposure and disabling password authentication where possible.

Security.NLNov 6, 2026Translated from NL