CONNECT WITH US
Cyber Security

Cyber Security

CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The Hacker News logo

Published on

Add as a preferred source on Google
CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.

The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement vulnerability via alternate authentication methods.

"An authentication enforcement vulnerability in SonicOS SSL-VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA)," SonicWall said in a Friday advisory.

The company also acknowledged that it "investigated a report indicating potential exploitation of this vulnerability," urging customers to update to the latest version as soon as possible. SonicWall did not disclose any additional specifics about the nature of the attack or who is behind the effort.

Also patched by SonicWall are a number of other high-severity flaws -

Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 20, 2026, to secure their networks against the threat.

The development comes days after SonicWall detailed two unpatched vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM).



Source link
Related Topics:Cyber Security

Disclaimer

We strive to uphold the highest ethical standards in all of our reporting and coverage. We TheMorningPulse.fyi want to be transparent with our readers about any potential conflicts of interest that may arise in our work. It's possible that some of the investors we feature may have connections to other businesses, including competitors or companies we write about. However, we want to assure our readers that this will not have any impact on the integrity or impartiality of our reporting. We are committed to delivering accurate, unbiased news and information to our audience, and we will continue to uphold our ethics and principles in all of our work. Thank you for your trust and support.