The U.S. Cybersecurity and Infrastructure Security Agency has officially added a serious vulnerability within SonicWall’s SonicOS SSL-VPN service to its Known Exploited Vulnerabilities catalog, signaling potential real-world attacks exploiting the flaw. Tracked as CVE-2026-19868, this issue allows users who have valid credentials via alternate authentication methods to skirt SAML controls and bypass multi-factor authentication requirements enforced through SAML. The vulnerability holds a CVSS score around 7.1-7.5, categorizing it as high severity.
Key Risks Uncovered
Although valid credentials are needed for the alternate authentication route, successful exploitation of this vulnerability undermines the integrity of SAML authentication—an identity federation standard built to secure access with added identity assurances. The bypass means that an attacker could gain access even if MFA is enabled, so long as they enter through an alternate auth method that isn’t properly gated by SAML in the impacted SSL-VPN service.
SonicWall has also said it has investigated reports suggesting this vulnerability may already be in use by attackers. Details remain sparse; no specific threat actors, methods, or scale of the breach have been publicly confirmed. Still, the existence of possible active exploitation makes patching urgent.
Other SonicOS Vulnerabilities and Timeline
In conjunction with CVE-2026-19868, several other critical flaws have been identified and patched:
- CVE-2026-107155: A cross-domain policy flaw in SonicOS management interface that under certain conditions could allow unauthorized remote actions by unauthenticated users.
- CVE-2026-107154: A session validation weakness in the management console, also permitting unauthorized operations without valid credentials in specific scenarios.
- CVE-2026-82308: A heap-based buffer overflow in the SSL-VPN service, exploitable before authentication, enabling denial-of-service attacks.
Federal civilian agencies in the U.S. have been advised to deploy the fixes by November 20, 2026, to protect against exploitation. SonicWall has additionally raised flags about vulnerabilities in its now end-of-life Global Management System software (CVE-2026-109593 and CVE-2026-109594), recommending users migrate to its supported Network Security Manager platform.
The timeline: CISA’s listing comes after SonicWall issued an advisory detailing this MFA bypass risk, confirmed that real-world exploitation may be underway, and encouraged users to implement the latest software versions. Other patches were released in tandem to address management interface risks and denial-of-service threats.
Implications and Best Practices
Organizations that use SonicWall’s SSL-VPN should treat this vulnerability seriously. Even if MFA via SAML is enabled, it may offer no protection if an alternate credential-based path exists. Audit authentication flows, disable weaker fallback methods if possible, and prioritize upgrading to patched SonicOS versions.
For agencies and businesses in more sensitive sectors, consider performing in-depth reviews of recent access logs for anomalous logins, especially where cross-domain or session validation flaws might have been exploited.
Enforcement and policy may also come into play: agencies and regulated entities that are part of U.S. federal supply chains will now face pressure to comply with deadlines such as the November 20 deadline for patching.
What this means: This isn’t just a single bug fix. It underscores how complex authentication ecosystems—especially ones mixing SAML, alternate auth paths, and legacy interfaces—can create hidden risks. This bypass is a strong reminder that MFA effectiveness depends heavily on consistent enforcement across all access paths. Going forward, we should see increased scrutiny on how authentication fallback options are implemented, and more demand for tighter validation in SSL-VPN solutions and network devices to prevent similar bypasses.
