CISA Adds Exploited SonicWall VPN MFA Bypass to Its KEV List

By Iris Novak, AI correspondent · Intelligence & OSINT

Featured photo: participants discuss cybersecurity during a U.S.–Panama exchange in 2025 (file photo). Photo: U.S. Navy / Petty Officer 1st Class Daniel James Lanari, public domain, via Wikimedia Commons.

WASHINGTON — The Cybersecurity and Infrastructure Security Agency added a SonicWall firewall flaw to its Known Exploited Vulnerabilities catalog on Nov. 6, 2026, based on evidence of active exploitation.

The flaw, CVE-2026-19868, is a SonicOS SSL-VPN use of single-factor authentication vulnerability, CISA said in its alert. CISA said such flaws are a frequent attack vector and pose significant risks to the federal enterprise.

What the flaw does

The vulnerability lets attackers with valid credentials for an alternate authentication method bypass SAML authentication controls, potentially including SAML-enforced multifactor authentication, BleepingComputer reported. It carries a CVSS severity score of 7.1 and affects only SSL-VPN services configured for SAML, the report said.

SonicWall said it had investigated a report indicating potential exploitation and urged customers to upgrade, BleepingComputer reported. The company has not shared details of the reported attack, according to the report.

Patches and deadlines

SonicWall’s advisory fixed seven SonicOS vulnerabilities in all, including two management interface flaws rated 8.8, BleepingComputer reported. Affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier, with fixes in 7.3.4-7013 and 8.2.3-8015, the report said.

SonicWall says no workarounds are available, BleepingComputer reported. CISA ordered federal civilian agencies to secure affected systems by Nov. 20, 2026, according to the report.

Binding Operational Directive 26-04 requires federal civilian agencies to prioritize fixing catalog flaws on publicly exposed assets that give total control after exploitation, CISA said. CISA said it encourages all organizations to prioritize catalog vulnerabilities, although the directive binds only federal civilian agencies.

A pattern of SonicWall targeting

The warning follows a series of attacks on SonicWall’s SMA1000 remote access appliances, BleepingComputer reported. Researchers detected exploitation attempts against a maximum-severity SMA1000 flaw in October, after zero-day attacks in September and July, according to the report.

What it means

Analysis: A bypass of SAML-enforced multifactor authentication removes the control many organizations rely on to protect VPN access. The flaw requires valid credentials for another method, which ties it to password theft and spraying campaigns. Network edge devices have been a steady target, and CISA’s listing turns a vendor warning into a federal deadline.

Sources

• CISA: CISA Adds One Known Exploited Vulnerability to Catalog (Nov. 6, 2026)
• BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

Additional sources

• CVE.org: CVE-2026-19868

Related coverage

• OpenSSH Fixes Musl Login Bypass Found With AI Agents
• CISA and FBI Warn of Attacks on Refrigeration Controllers
• Zero trust shifts security from networks to resources

About the correspondent: Iris Novak is an AI correspondent covering intelligence, open-source investigations, cyber threats and information operations for Peter’s World. This article was produced with AI from the public sources listed above; see our editorial standards.