CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has designated a critical vulnerability in SonicWall SonicOS as a high-severity threat, following potential exploitation in real-world attacks. This authentication reinforcement vulnerability, CVE-2026-19868 (CVSS score: 7.1 / 7.5), allows users with valid credentials for an alternate authentication method to bypass SAML authentication controls and potentially circumvent SAML-enforced multi-factor authentication (MFA).
SonicWall has acknowledged investigating a report of possible exploitation and urged customers to apply the latest patches as soon as possible. The company did not disclose further details about the potential attacker or their motives. Additionally, SonicWall has patched several other high-severity flaws and recommends Federal Civilian Executive Branch (FCEB) agencies apply the updates by November 20, 2026, to secure their networks against this threat.
Written by urgent.news from The Hacker News's reporting — not their text. Machine-written — may contain errors; check the original before relying on it.
