cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

CISA Adds SonicWall SonicOS MFA Bypass Flaw to KEV Catalog Amid Potential Exploitation Reports

· Original article ↗

Summary

CISA added SonicWall SonicOS flaw CVE-2026-19868 to its KEV catalog. SonicWall says valid credentials for an alternate authentication method may bypass SAML and enforced MFA; it investigated a potential exploitation report and urged customers to update.

Key points

  • CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog after reports of possible real-world exploitation.
  • The flaw affects the SonicOS SSL-VPN service and may let users with valid alternate-method credentials bypass SAML authentication and enforced MFA.
  • SonicWall investigated a report of potential exploitation but disclosed no attack details or suspected actor.
  • SonicWall urged customers to update to the latest version; FCEB agencies were advised to apply patches by November 20, 2026.
  • SonicWall also urged users of end-of-life GMS systems affected by CVE-2026-109593 and CVE-2026-109594 to upgrade to NSM.

Article Details

Vulnerability Types
  • Authentication enforcement vulnerability allowing SAML authentication and SAML-enforced MFA bypass via alternate authentication methods
Severity
High; CVSS score reported as 7.1 / 7.5
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

CVE

CVE-2026-109593SonicWall · Global Management System (GMS)detailed two unpatched vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM).CVE-2026-109594SonicWall · Global Management System (GMS)vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM).CVE-2026-19868SonicWall · SonicOSThe vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement vulnerability via alternate authentication methods.

Vendors

SonicWalland Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have

Products

Global Management System (GMS)comes days after SonicWall detailed two unpatched vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to NetworkNetwork Security Manager (NSM)System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM).SonicOSand Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been

Countries

United StatesThe U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said

Related Articles