CISA flags SonicWall flaw that can bypass MFA
The US agency added the SonicOS vulnerability to its exploited-flaws list after reports of possible attacks. SonicWall says the flaw may let users bypass multi-factor authentication enforced through SAML.
CISA added SonicWall vulnerability CVE-2026-19868 to its Known Exploited Vulnerabilities catalog after reports it may have been used in real-world attacks. The Hacker News
SonicWall says the flaw in the SonicOS SSL-VPN service could let someone who has valid credentials for another authentication method get around SAML controls, including multi-factor authentication enforced through SAML. The Hacker NewsHelp Net Security
SonicWall has released a fix and urged administrators to patch quickly; no workarounds are listed. US federal agencies have been advised to apply patches by 20 November. The Hacker NewsHelp Net Security