CISA Warns of SonicWall SonicOS Flaw That Can Bypass SAML and MFA Checks
The U.S. Cybersecurity and Infrastructure Security Agency has added a SonicWall SonicOS vulnerability, CVE‑2026‑19868, to its Known Exploited Vulnerabilities catalog. The bug can bypass SAML authentication and multi‑factor checks when attackers hold valid alternate credentials, prompting urgent reviews of exposed devices.
A vulnerability in SonicWall’s SonicOS has been flagged by the U.S. Cybersecurity and Infrastructure Security Agency (CISA) as a known exploited flaw, highlighting a risk that attackers can get past multi‑factor protections under some conditions.
On 9 November, CISA added CVE‑2026‑19868 to its Known Exploited Vulnerabilities catalog. That list is reserved for security issues where there is evidence they are being used in real‑world attacks.
According to public reporting, the bug affects SonicWall’s implementation of SAML, a standard that lets one login service vouch for a user across different systems. Exploiting the flaw can enable someone with valid alternate credentials to bypass both the SAML process and multi‑factor authentication.
Multi‑factor authentication, or MFA, usually combines a password with a second step, such as a code or hardware token. It is widely used as a safeguard in case passwords are stolen. A weakness that allows an attacker to skip that extra step reduces the benefit organizations expect from MFA.
SonicWall has said it is investigating a report of possible exploitation. The company has not yet published full technical details in the material cited, but CISA’s move puts pressure on operators to identify affected SonicOS deployments and prepare for patches or mitigations.
Many organizations use SonicWall devices to control remote access to internal networks. If an attacker gets through by abusing CVE‑2026‑19868, they could appear to internal systems as an authenticated user and then move deeper into the network.
The flaw underlines how identity and login protocols themselves can become entry points. Attackers do not have to defeat encryption if they can instead take advantage of a logic error that accepts one set of credentials in place of another.
Security teams now need to track SonicWall advisories on CVE‑2026‑19868, deploy any updated firmware promptly, and watch device and identity‑provider logs for irregular login patterns that might reflect MFA being bypassed.
CISA’s listing also matters for U.S. federal agencies, which are required to treat items in the Known Exploited Vulnerabilities catalog as remediation priorities on their networks.
Sources
- OSINT