"An authentication enforcement vulnerability in SonicOS SSL-VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls," SonicWall said in a Friday advisory.
CVE-2026-19868: a high-severity MFA bypass flagged by CISA
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog after reports that the flaw may have been exploited in the wild. The vulnerability — tracked as CVE-2026-19868 and scored 7.1 / 7.5 on the Common Vulnerability Scoring System — is described by SonicWall as an "authentication reinforcement vulnerability via alternate authentication methods" in the SonicOS SSL‑VPN service.
SonicWall’s advisory warns that the flaw "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls" and that "successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)." CISA’s addition of the flaw to the KEV catalog signals federal concern that reported activity rises to the level of observed exploitation.
SonicWall patches multiple high-severity SonicOS flaws
Alongside CVE-2026-19868, SonicWall issued patches for several other high-severity SonicOS vulnerabilities. The vendor listed three additional issues and their CVSS scores:
- CVE-2026-107155 (CVSS 8.8) — a permissive cross-domain policy vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions.
- CVE-2026-107154 (CVSS 8.8) — a session validation vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions.
- CVE-2026-82308 (CVSS 7.5) — a pre-authentication heap-based buffer overflow vulnerability in the SonicOS SSL‑VPN service that could potentially enable a remote unauthenticated attacker to cause an application-level denial-of-service.
SonicWall’s advisory groups these fixes with CVE-2026-19868 as part of a broader update cycle; customers are urged to apply the available updates.
The cyber insurance questionnaire just landed. Now what?
SOC 2, HIPAA, insurance renewals - someone has to own security strategy. Nubivance provides fractional CISO leadership without the full-time salary.
Get a security leadCISA guidance and federal patching deadline: November 20, 2026
CISA’s KEV listing carries a concrete operational instruction for federal civilian agencies. The agency recommended that Federal Civilian Executive Branch (FCEB) agencies apply the patches by November 20, 2026, to protect their networks from the identified threats. That deadline compresses patching windows for agencies that use SonicOS-based SSL‑VPN or management interfaces and assigns a near-term compliance requirement tied to the KEV catalog listing.
SonicWall’s investigation and the limits of the public record
SonicWall acknowledged in its advisory that it "investigated a report indicating potential exploitation of this vulnerability" but did not disclose additional specifics about the nature of the attack or who might be behind it. The company reiterated its standard operational guidance by urging customers to update to the latest SonicOS version as soon as possible.
The advisory also separately noted two unpatched vulnerabilities affecting end-of-life Global Management System (GMS) installations — CVE-2026-109593 and CVE-2026-109594 — and advised customers to migrate to the Network Security Manager (NSM) platform.
What this means for Federal agencies, enterprise security teams, and GMS users
- Federal Civilian Executive Branch agencies: Agencies are under explicit instruction to apply the SonicOS fixes by November 20, 2026, to meet the KEV-driven mitigation timeline and reduce exposure to reported exploitation.
- Enterprise security teams running SonicOS SSL‑VPN or management interfaces: Teams will need to prioritize the specific patches for CVE-2026-19868, CVE-2026-107155, CVE-2026-107154, and CVE-2026-82308 and verify whether their authentication configurations use alternate methods that might be susceptible to the described bypass.
- Organizations still operating GMS (end-of-life): SonicWall has called attention to two unpatched GMS vulnerabilities (CVE-2026-109593 and CVE-2026-109594) and urged upgrades to Network Security Manager (NSM), signaling that GMS users face unresolved risk unless they migrate.
The chain of events is straightforward and consequential: CISA’s KEV designation follows reports of possible real-world exploitation, SonicWall has released patches for multiple high-severity SonicOS flaws and urged immediate updating, and federal agencies have been given a firm patching deadline of November 20, 2026. SonicWall’s disclosure that it has investigated a potential exploitation but has not provided further details leaves a gap that will matter to defenders and auditors working on tight timelines. For now, the practical step—apply the available SonicOS updates and, where relevant, plan migration off end-of-life GMS—is the clear next move.
