SonicWall VPN Flaw Lets Attackers Sidestep Multi-Factor Authentication, and CISA Says It May Be Under Attack

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity SonicWall SonicOS vulnerability to its Known Exploited Vulnerabilities catalog. CISA acted after reports that the flaw may have been used in real-world attacks. The issue is tracked as CVE-2026-19868 and carries a CVSS score of 7.1 / 7.5.

According to SonicWall, the flaw is an authentication enforcement problem in the SonicOS SSL-VPN service. A user who holds valid credentials for an alternate authentication method may be able to bypass SAML authentication controls. Successful exploitation may also bypass multi-factor authentication (MFA) enforced through SAML. SonicWall said it investigated a report indicating potential exploitation and urged customers to update to the latest version as soon as possible. It did not share further details about the attacks or who may be behind them. The company also patched several other high-severity flaws.

U.S. federal civilian agencies have been told to apply the patches by November 20, 2026. The news follows SonicWall's disclosure of two unpatched vulnerabilities (CVE-2026-109593 and CVE-2026-109594) affecting end-of-life Global Management System (GMS) products. SonicWall is urging those customers to upgrade to Network Security Manager (NSM). This summary is based on the opening of the source article, so some details may not be covered here.