CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation Ravie LakshmananNov 09, 2026Vulnerability / Network Security The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement vulnerability via alternate authentication methods. "An authentication enforcement vulnerability in SonicOS SSL-VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)," SonicWall said in a Friday advisory. The company also acknowledged that it "investigated a report indicating potential exploitation of this vulnerability," urging customers to update to the latest version as soon as possible. SonicWall did not disclose any additional specifics about the nature of the attack or who is behind the effort. Also patched by SonicWall are a number of other high-severity flaws - CVE-2026-107155 (CVSS score: 8.8) - A permissive cross-domain policy vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions. CVE-2026-107154 (CVSS score: 8.8) - A session validation vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions. CVE-2026-82308 (CVSS score: 7.5) - A pre-authentication heap-based buffer overflow vulnerability in the SonicOS SSL-VPN service that could potentially enable a remote unauthenticated attacker to cause an application level denial-of-service. Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 20, 2026, to secure their networks against the threat. The development comes days after SonicWall detailed two unpatched vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM). Found this article interesting? Follow us on Google News, Twitter and LinkedIn to read more exclusive content we post. Authentication, cybersecurity, network security, Vulnerability PHP2Shell Attack Roots 25 Servers, Breaches U.S. Government-Affiliated Network Leaked LiteLLM Master Key Let Attackers Steal GitHub Tokens and Hijack Release Pipeline GoAhead TLS Flaws Allow Revoked Client Certificates and Enable Session Decryption Microsoft Authenticator Flaw Let Permissionless Android Apps Steal Work Account Tokens China-Linked Hackers Exploited VMware ESX Zero-Day to Reduce Audit Trail Visibility Unpatched Tailscale SSH Flaws Could Let a Hacked Device Reach Root on Other Servers Linux Kernel TCP Flaw With 9.8 CVSS Score Affects Ubuntu, Red Hat and Other Distributions Critical 16-Year-Old UEFI Flaw Can Run Code Before Secure Boot on Network-Booting Servers CyberStrikeAI Uses 44 AI Agents to Automate Hacking Operations Against Japan Targets AI-Generated Fake Login Pages Are Making Account Takeovers Easier American Organizations Under Attack: Skyw4lker Device Code Phishing Campaign Exposed ThreatsDay: Critical Firewall Flaws, Banking Trojans Rented, Weaponized PDF, Token Theft + 26 More Stories TeamViewer Flaw Lets Remote Computers Attack Users Who Connect to Control Them Binance Suffers Security Breach Affecting $6.3 Billion in Assets, Nearly $3 Billion Frozen Attackers Exploit PHP2Shell Flaws in Internet-Exposed Palo Alto Networks Management Interfaces Why Urgent Security Fixes Aren't Fixed. Observe, Prove, Act, Confirm Gets Them Moving Chinese Hackers Use AI-Powered ARTEX to Target Over 200 Organizations Worldwide Anthropic's Unreleased AI Model Chains Flaws Into Working Chrome, Safari, Windows and Linux Exploits Cisco Patches Actively Exploited ASA and FTD VPN Flaw That Can Crash Firewalls The Rise of the Threat Operator: How AI Will Redefine Security Operations and Careers Microsoft 365 Token-Replay Attacks Compromise 97 Accounts at 79 Organizations PHP Issues Second Windows Security Update in Five Days to Fix Brotli Code Execution Flaw Official Claude Code Extension on Cursor Marketplace Trojanized with Persistent SSH Backdoor Brotli Decoder Flaw Behind Node.js RCE Also Affects Bun, Python and Other Widely Used Software See How Bitdefender GravityZone Identifies Shadow AI and Prioritizes Endpoint Risks Beyond CVE Scanning: Book a Demo of Continuous AI-Powered Web Pentesting Detect Lateral Movement and Evasive Attacks With Corelight's Open NDR Platform Assess Your Organization's AI Code Sprawl Exposure With This Practical Guide Your SOC Has an Identity Blind Spot. Here's How to Fix It Learn how to close critical identity visibility gaps in your SOC, detect hidden threats, and accelerate incident response across human, machine, and AI identities. Join the Webinar Roadmap for AI-Ready Security Operations Evaluate Attack Surface Visibility With an AI Threat Readiness Framework Learn how to assess AI threat readiness, strengthen attack surface visibility, and prepare security operations for emerging threats in this practical webinar. Governance Sets the Ceiling on Your AI Security Program See the five moves that raise a Stage 2 Govern score to a defensible Stage 3. 11 Real Stories: How Identity Exposure Unlocks Active Attack Paths Map cross-domain privilege escalation to sever breach routes at key choke points. See how Identity Dark Matter impacts your GRC, IR, and Infrastructure. Watch the video. BeyondTrust an 8X Gartner® Magic Quadrant™ Leader for PAM Gain clarity on the PAM market and understand why BeyondTrust is again a Leader. The Collapsed Patch Window: Why Runtime Protection is Now Your First Line of Defense Against AI-Driven Attacks Your Attack Surface Is Growing Faster Than Your Team Can Respond The MSP Margin Math Nobody's Doing: Your Next Technician Might Already be on Payroll PEDM vs. Standing Elevated Privileges: Control Access Without Flooding the Helpdesk