Title: SonicWall SSL-VPN MFA Bypass Flaw CVE-2026-19868 Added to CISA’s KEV Catalog
Summary: SonicWall has patched CVE-2026-19868, a high-severity flaw in the SonicOS SSL-VPN service that lets a user holding valid credentials for an alternate authentication method bypass SAML authentication controls — including SAML-enforced multi-factor MFA — and, per The Hacker News, rated CVSS 7.1/7.5. SonicWall acknowledged it “investigated a report indicating potential exploitation of this vulnerability” and urged customers to update to the latest version as soon as possible. CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6 on the basis of evidence of active exploitation, giving federal civilian executive branch agencies until November 20, 2026 to apply the patches. The same SonicWall advisory covers three further high-severity SonicOS issues: CVE-2026-107155 and CVE-2026-107154 (both CVSS 8.8), a permissive cross-domain policy flaw and a session validation flaw as described by The Hacker News, each in the SonicOS management interface and exploitable by a remote unauthenticated attacker under specific conditions, and CVE-2026-82308 (CVSS 7.5), a pre-authentication heap-based buffer overflow in the SSL-VPN service that can cause a denial of service. The KEV addition follows days after SonicWall detailed two flaws, CVE-2026-109593 and CVE-2026-109594, in end-of-life Global Management System appliances for which it will not ship patches, urging a migration to Network Security Manager. Administrators running SonicOS SSL-VPN should treat the update as urgent, since the KEV listing confirms exploitation evidence and device-based VPN gateways are a standard foothold.
References: