CISA adds SonicWall MFA bypass flaw to exploited list

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a critical SonicWall SonicOS vulnerability to its Known Exploited Vulnerabilities catalog. This action follows reports that the flaw, which allows attackers to bypass multi-factor authentication, is being actively exploited in real-world attacks.

What happened

CISA identified CVE-2026-19868 as a high-severity issue with a CVSS score ranging from 7.1 to 7.5. The agency stated that there are indications this vulnerability has been used in active campaigns, prompting its inclusion in the catalog to enforce rapid patching for federal agencies. SonicWall confirmed it investigated a report indicating potential exploitation, though it did not release details about the threat actors or the specific nature of the attacks.

In addition to the MFA bypass, SonicWall patched several other high-severity flaws in the same advisory. These include CVE-2026-107155 and CVE-2026-107154, both with CVSS scores of 8.8, which affect the management interface. Another flaw, CVE-2026-82308, involves a pre-authentication heap-based buffer overflow in the SSL-VPN service that could lead to denial-of-service conditions. Federal Civilian Executive Branch agencies have been directed to apply these patches by November 20, 2026.

This announcement arrives shortly after SonicWall addressed two unpatched vulnerabilities in its end-of-life Global Management System. Those flaws, CVE-2026-109593 and CVE-2026-109594, remain unpatched for legacy systems, with the vendor urging customers to migrate to the Network Security Manager platform instead.

How it works

The core vulnerability, CVE-2026-19868, is an authentication enforcement error within the SonicOS SSL-VPN service. It specifically impacts environments using SAML for single sign-on and multi-factor authentication. The flaw allows a user who possesses valid credentials for an alternate authentication method to bypass SAML controls entirely.

In practical terms, if an organization enforces MFA via SAML but also permits another login method, an attacker can leverage that alternate path to skip the MFA requirement. This design gap means that the presence of strong authentication factors does not guarantee protection if the system fails to enforce them across all entry points. The other patched vulnerabilities involve permissive cross-domain policies and session validation errors, which could allow remote, unauthenticated attackers to perform unauthorized operations on the management interface under specific conditions.

Key details

• Primary Vulnerability: CVE-2026-19868 allows bypass of SAML-enforced MFA via alternate authentication methods.
• Severity: CVSS score is listed as 7.1 to 7.5; CISA classifies it as actively exploited.
• Additional Flaws: Two management interface vulnerabilities (CVE-2026-107155, CVE-2026-107154) scored 8.8, plus a DoS flaw (CVE-2026-82308).
• Deadline: Federal Civilian Executive Branch agencies must patch by November 20, 2026.
• Legacy Systems: Two unpatched flaws remain in end-of-life Global Management System products.
• Vendor Response: SonicWall urges immediate updates but has not disclosed attacker identities or specific exploit techniques.

Why it matters

For engineering teams and IT leads, this incident highlights the fragility of mixed authentication architectures. Many organizations layer SAML-based MFA on top of existing directory services, assuming this provides uniform protection. However, if the underlying platform allows alternate login paths that do not trigger the same MFA checks, the security control is effectively nullified. This is not just a configuration error but a logic flaw in how the VPN service enforces authentication policies.

The inclusion of this flaw in the CISA Known Exploited Vulnerabilities catalog raises the stakes for remediation. Unlike standard advisories, KEV listings often drive mandatory compliance actions for government contractors and critical infrastructure providers. The short window until the November 20 deadline for federal agencies suggests that widespread scanning and exploitation attempts are likely already underway in the private sector as well.

Furthermore, the persistence of unpatched vulnerabilities in end-of-life products like the Global Management System serves as a reminder of technical debt risks. Organizations relying on legacy management planes may find themselves exposed to similar authentication or management interface flaws without a clear path to remediation other than full platform migration.

What you can do

• Update SonicWall SonicOS firmware to the latest version immediately to address CVE-2026-19868 and associated flaws.
• Audit your SSL-VPN configuration to ensure no alternate authentication methods bypass SAML MFA requirements.
• Verify that management interface access is restricted to trusted IP ranges to mitigate risks from CVE-2026-107155 and CVE-2026-107154.
• Plan migration away from end-of-life Global Management System instances to Network Security Manager.
• Monitor network logs for unusual VPN login patterns that may indicate attempted exploitation of alternate auth paths.
• Confirm patch application before November 20, 2026, if your organization falls under federal compliance mandates.