CISA adds SonicWall SonicOS MFA bypass flaw to KEV catalog
CISA lists SonicWall SonicOS MFA bypass risk
The U.S. Cybersecurity and Infrastructure Security Agency has added CVE-2026-19868, a high-severity vulnerability in SonicWall SonicOS, to its Known Exploited Vulnerabilities catalog. The flaw affects the SonicOS SSL-VPN service, carries a CVSS score of 7.1 out of 7.5, and was listed after reports that it may have been exploited in real-world attacks.
SonicWall characterises CVE-2026-19868 as an authentication enforcement vulnerability involving alternate authentication methods. A user holding valid credentials for an alternate method may be able to bypass SAML authentication controls. Successful exploitation may also bypass multi-factor authentication enforced through SAML.
The vendor said it investigated a report indicating potential exploitation, but did not publish further information on the reported attack activity or the party behind it. SonicWall has urged customers to update to the latest available version as soon as possible.
Other high-severity fixes affect management and VPN services
The update also addresses CVE-2026-107155 and CVE-2026-107154, both rated 8.8. The first is a permissive cross-domain policy issue in the SonicOS management interface, while the second concerns session validation in that interface. Under specific conditions, either vulnerability could enable a remote unauthenticated attacker to perform unauthorised operations.
SonicWall additionally patched CVE-2026-82308, rated 7.5, a pre-authentication heap-based buffer overflow in the SonicOS SSL-VPN service. The stated impact is an application-level denial of service by a remote unauthenticated attacker.
The new listing follows a broader pattern of SonicWall-related security reporting: SonicWall, SaaS and DNS attacks included attacks affecting SonicWall alongside SaaS and DNS, while this case focuses on a control designed to protect remote access itself.
Patch deadline and operational response
CISA recommends that Federal Civilian Executive Branch agencies apply the patches by November 20, 2026. The KEV catalog is intended to identify vulnerabilities that demand prioritised remediation because of evidence of exploitation or credible exploitation risk.
Separately, SonicWall recently disclosed two unpatched vulnerabilities in end-of-life Global Management System deployments, CVE-2026-109593 and CVE-2026-109594, and advised customers to move to Network Security Manager.
For organisations running SonicOS, the practical implication is to identify SSL-VPN and management-interface deployments, install the available fixes on a prioritised basis, and confirm that SAML authentication and its MFA enforcement remain active after remediation.