U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalog
CISA adds SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to KEV catalog.
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a SonicWall SonicOS SSLVPN vulnerability, CVE-2026-19868, to its Known Exploited Vulnerabilities (KEV) catalog. This flaw allows an attacker with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially circumventing multi-factor authentication (MFA). SonicWall is investigating reports of exploitation and urges customers to update their systems immediately.
AI summary of the linked source. Not reviewed by an editor. How this works
Run SonicWall?
Get an email when a new story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
The lesson from this incident
Full lessonA critical authentication bypass vulnerability in SonicWall SonicOS SSLVPN (CVE-2026-19868) is being actively exploited, allowing attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls and circumvent MFA protections entirely. This matters because VPN gateways are high-value perimeter targets — compromising one can grant broad internal network access. CISA's addition to the KEV catalog signals confirmed in-the-wild exploitation, meaning unpatched organizations face immediate, credible risk. The incident highlights how even layered controls like MFA can be rendered ineffective when underlying authentication logic contains flaws in critical network appliances.
What helps against this
How we list vendors
- Phishing-resistant MFA
A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.
- Identity threat detection and response (ITDR)
Attackers who log in with real, stolen credentials get noticed.
- Automated patch management
Known holes get closed in days, not months.
Indicators of Compromise
Extracted by AI from the linked source. Not reviewed by an editor. How this works
- cve — CVE-2026-19868