CISA has warned that attackers are actively exploiting a high-severity flaw in SonicWall firewalls that could let them bypass some authentication steps, including multifactor authentication (MFA).
The vulnerability, tracked as CVE-2026-19868, received a CVSS severity score of 7.1 and affects the SSL VPN service in SonicWall’s SonicOS operating system.
CISA added the flaw to its KEV catalog on Nov. 6. In a security advisory published on the same day, SonicWall did not explicitly confirm its active exploitation, stating that its Product Security Incident Response Team (PSIRT) had investigated “a report indicating potential exploitation of this vulnerability.”
CVE-2026-19868 could allow an attacker who obtained valid credentials for an alternative authentication method to bypass SAML authentication controls if they are enabled for SSL VPN logins.
Successful exploitation of the flaw could also bypass MFA enforced via SAML, potentially granting attackers unauthorized access to corporate networks without requiring them to complete the expected authentication process.
Neither SonicWall nor CISA has publicly disclosed details about the flaw’s reported exploitation or affected organizations.
SonicWall urges customers to install updates
CVE-2026-19868 affects SonicOS 7.3.3-7015 and earlier versions running on Gen 7 firewalls, along with SonicOS 8.2.2-8015 and earlier versions running on Gen 8 devices.
Notably, it only impacts these versions if SAML is enabled for SSLVPN logins, so organizations can check which of their firewalls use that setup.
SonicWall has addressed CVE-2026-19868 in SonicOS 7.3.4-7013 and 8.2.3-8015, respectively, and has strongly urged affected customers to “upgrade to the latest release as soon as possible to mitigate the associated risks.” It listed no workaround.
Its security update addresses six additional vulnerabilities, including two high-severity management interface flaws that could allow unauthorized operations under certain conditions.
Under Binding Operational Directive 26-04, US federal civilian agencies are required to remediate CVE-2026-19868 by Nov. 20. CISA’s catalog entry does not require them to carry out forensic triage for this flaw, only to apply SonicWall’s fixes.
