Authentication & Identity Security – First Hackers News https://firsthackersnews.com Latest cybersecurity news, real attacks, and practical IOCs—made simple and actionable. Mon, 09 Nov 2026 11:01:07 +0000 en-US hourly 1 https://wordpress.org/?v=6.9.9 https://firsthackersnews.com/wp-content/uploads/2026/03/cropped-FHN_512x512-32x32.png Authentication & Identity Security – First Hackers News https://firsthackersnews.com 32 32 CISA Flags SonicWall MFA Bypass Vulnerability Following Reports of Exploitation https://firsthackersnews.com/cisa-flags-sonicwall-mfa-bypass-vulnerability-following-reports-of-exploitation/ https://firsthackersnews.com/cisa-flags-sonicwall-mfa-bypass-vulnerability-following-reports-of-exploitation/#respond Mon, 09 Nov 2026 11:01:06 +0000 https://firsthackersnews.com/?p=12690 The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity authentication bypass vulnerability affecting SonicWall SonicOS

The post CISA Flags SonicWall MFA Bypass Vulnerability Following Reports of Exploitation appeared first on First Hackers News.

]]> The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity authentication bypass vulnerability affecting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports of potential exploitation in real-world attacks.

The vulnerability, tracked as CVE-2026-19868, carries a CVSS score of 7.1 and affects the SSL VPN service in SonicWall firewalls.

SAML Authentication and MFA Bypass

According to SonicWall, the vulnerability occurs when the SSL VPN service fails to properly enforce SAML authentication controls.

An attacker with valid credentials for an alternative authentication method could exploit the weakness to bypass SAML-based authentication. This may also allow them to circumvent multi-factor authentication (MFA) enforced through SAML.

The vulnerability is not an unauthenticated access flaw, as attackers require valid credentials for an alternative authentication method.

Potential Exploitation Reported

SonicWall confirmed that its Product Security Incident Response Team (PSIRT) investigated a report indicating possible exploitation of the vulnerability.

However, the company has not disclosed further details about the suspected attacks or identified the threat actors involved.

CISA added CVE-2026-19868 to its KEV catalog on November 6, 2026, confirming that the vulnerability has been exploited in the wild.

Affected SonicWall Products

The vulnerability affects SonicWall SonicOS SSL VPN deployments using SAML authentication.

Affected firmware versions include:

  • Gen7 devices running SonicOS 7.3.3-7015 and earlier.
  • Gen8 devices running SonicOS 8.2.2-8015 and earlier.

SonicWall has addressed the vulnerability in:

  • SonicOS 7.3.4-7013
  • SonicOS 8.2.3-8015

The company stated that no workaround is available and strongly recommends upgrading to the latest supported release.

The post CISA Flags SonicWall MFA Bypass Vulnerability Following Reports of Exploitation appeared first on First Hackers News.

]]> https://firsthackersnews.com/cisa-flags-sonicwall-mfa-bypass-vulnerability-following-reports-of-exploitation/feed/ 0