CISA Flags SonicWall MFA Bypass Amid Exploitation Reports

CISA added a critical SonicWall SonicOS vulnerability to its Known Exploited Vulnerabilities catalog after reports of potential real-world exploitation emerged. The flaw resides in the SSL-VPN service, and SonicWall confirmed it investigated accounts of weaponized use. The vendor declined to disclose specifics about the attack campaigns or responsible actors.

The vulnerability (CVE-2026-19868) allows attackers holding valid credentials for any alternate authentication method to circumvent SAML-enforced multi-factor authentication. This means a compromised password to one auth system becomes sufficient to bypass MFA and penetrate identity controls—effectively turning credential theft into a path through layered defenses.

SonicWall simultaneously patched three additional high-severity issues in SonicOS, including pre-authentication buffer overflows and management interface flaws that expose systems to unauthenticated remote compromise. Federal agencies face a November 20 deadline to apply patches. The advisory follows recent warnings about unpatched end-of-life Global Management System deployments that SonicWall no longer maintains, pointing to broader infrastructure exposure across its customer base.