CISA Adds SonicWall SonicOS Flaw CVE-2026-19868 to KEV Catalog

The United States Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity authentication flaw affecting SonicWall SonicOS to its Known Exploited Vulnerabilities catalogue. Tracked as CVE-2026-19868, the vulnerability resides in the SonicOS SSL-VPN service and allows authenticated users with alternate credentials to bypass SAML authentication controls, including multi-factor authentication. SonicWall confirmed investigating reports of potential in-the-wild exploitation. Malaysian organisations utilising these systems should audit their environments and report suspicious activity to Cyber999.

Key Facts

How Does the SonicOS MFA Bypass Vulnerability Work?

The vulnerability, tracked as CVE-2026-19868, involves an authentication enforcement issue within the SonicOS SSL-VPN service. It enables a user with valid credentials for an alternate authentication method to bypass Security Assertion Markup Language controls entirely. This failure permits the circumvention of SAML-enforced multi-factor authentication mechanisms protecting enterprise networks.

SonicWall documented the issue in an advisory as an authentication reinforcement vulnerability via alternate authentication methods. When environments employ SAML single sign-on backed by multi-factor authentication, an attacker with valid credentials for a secondary authentication method can sidestep SAML enforcement controls on the SSL-VPN endpoint.

"An authentication enforcement vulnerability in SonicOS SSL-VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA),"

SonicWall

SonicWall confirmed that successful exploitation enables a user with valid credentials for an alternate authentication method to bypass SAML-enforced multi-factor authentication.

Is the Flaw Being Exploited in the Wild?

Yes, the United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalogue following reports of real-world exploitation. SonicWall acknowledged investigating an incident report suggesting the flaw was actively leveraged, although the vendor disclosed no technical attack specifics or threat-actor attribution.

CISA has mandated that Federal Civilian Executive Branch agencies apply available vendor updates by November 20, 2026. SonicWall has urged all customers to apply patches promptly, but the vendor has refrained from providing technical specifics regarding attack methodology or identifying the adversaries responsible for the intrusion attempts.

SonicWall acknowledged it investigated a report indicating potential exploitation of CVE-2026-19868 in real-world attacks.

What Other SonicOS Vulnerabilities Were Patched?

SonicWall resolved three additional high-severity security vulnerabilities impacting SonicOS management interfaces and SSL-VPN services. These include two unauthorised operation vulnerabilities rated CVSS 8.8 and a denial-of-service buffer overflow flaw rated 7.5. Remote unauthenticated attackers could potentially perform unauthorised operations or cause service crashes under specific operational conditions.

The addressed flaws comprise CVE-2026-107155 (a permissive cross-domain policy flaw) and CVE-2026-107154 (a session validation flaw), each scoring 8.8 on the SonicOS management interface. Additionally, CVE-2026-82308 (CVSS 7.5) affects the SSL-VPN service via a pre-authentication heap-based buffer overflow that permits denial-of-service conditions. SonicWall also warned of two unpatched flaws impacting legacy Global Management System deployments.

The patched flaws CVE-2026-107155 and CVE-2026-107154 permit remote unauthenticated attackers to perform unauthorised operations on the SonicOS management interface under specific conditions.

What Should You Do?

• Update SonicWall SonicOS firewalls to the latest official version immediately.
• Federal Civilian Executive Branch agencies must apply the necessary patches by November 20, 2026.
• Upgrade unsupported end-of-life Global Management System installations to Network Security Manager to address unpatched vulnerabilities CVE-2026-109593 and CVE-2026-109594.
• Malaysian organisations identifying suspicious network activity or potential compromises should report incidents to Cyber999 (MyCERT).

Common Questions

What is the severity and CVSS score of CVE-2026-19868?

The vulnerability is classified as high-severity with a Common Vulnerability Scoring System metric between 7.1 and 7.5. It affects the SonicOS SSL-VPN service by weakening authentication enforcement, allowing credentialed users using alternate methods to bypass mandatory SAML and multi-factor authentication controls.

What is the remediation deadline for organisations?

United States Federal Civilian Executive Branch agencies must apply SonicWall updates by November 20, 2026, under CISA mandate. SonicWall urges all general enterprise customers to update their firewalls to the latest firmware release immediately to mitigate active exploitation risks.

Which other SonicWall products require migration or patching?

SonicWall highlighted two unpatched vulnerabilities affecting legacy, end-of-life Global Management System deployments, tracked as CVE-2026-109593 and CVE-2026-109594. The vendor strongly recommends administrators migrate immediately from the unsupported GMS platform to Network Security Manager to maintain network defence.

Sources and Methodology

This dispatch is based solely on reporting published by The Hacker News on Nov 09, 2026 (source report). No additional vendor advisories, external technical analyses, or primary documents were reviewed or verified.