CISA Flags SonicWall MFA Bypass Vulnerability Following Reports Of Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity authentication bypass vulnerability affecting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of potential exploitation in real-world attacks.

The vulnerability, tracked as CVE-2026-19868, carries a CVSS score of 7.1 and affects the SSL VPN service in SonicWall firewalls.

SAML Authentication and MFA Bypass

According to SonicWall, the vulnerability occurs when the SSL VPN service fails to properly enforce SAML authentication controls.

An attacker with valid credentials for an alternative authentication method could exploit the weakness to bypass SAML-based authentication. This may also allow them to circumvent multi-factor authentication (MFA) enforced through SAML.

The vulnerability is not an unauthenticated access flaw, as attackers require valid credentials for an alternative authentication method.

Potential Exploitation Reported

SonicWall confirmed that its Product Security Incident Response Team (PSIRT) investigated a report indicating possible exploitation of the vulnerability.

However, the company has not disclosed further details about the suspected attacks or identified the threat actors involved.

CISA added CVE-2026-19868 to its KEV catalog on November 6, 2026, confirming that the vulnerability has been exploited in the wild.