CISA Adds SonicWall SonicOS MFA Bypass Flaw to Exploited Vulnerabilities List
Organisations running SonicOS should patch quickly, since the flaw may already be in use against systems that rely on SAML-based multi-factor authentication.
CISA has put a high-severity SonicWall SonicOS flaw, CVE-2026-19868, into its Known Exploited Vulnerabilities catalog after reports of possible real-world abuse. According to SonicWall's advisory, a user holding valid credentials for an alternate authentication method could potentially sidestep SAML controls, and possibly SAML-enforced multi-factor authentication. SonicWall also patched several other high-severity SonicOS flaws and urged customers to upgrade promptly, though it gave no detail on the suspected attack or its source. Separately, CISA added four flaws in GPUStack, FreeSWITCH, OpenSSH and IBM Aspera Faspex to the same catalog, and for OpenSSH flaw CVE-2026-123158 it cited exploitation attempts from November 6, 2026 onward. Federal civilian agencies are advised to apply the fixes by November 12, 2026 for the second batch and November 20, 2026 for the SonicWall patches.
Why it matters
The flaw could let someone who already holds valid credentials for an alternate sign-in method get past SAML controls, and possibly the multi-factor checks that depend on them. That weakens a protection many organisations rely on to limit access to their networks. Because CISA has placed the flaw in its catalog after reports of possible exploitation, the risk is no longer hypothetical for SonicOS users. Federal civilian agencies have been told to apply the SonicWall patches by November 20, 2026, and the broader lesson is that a valid credential paired with a bypass can undermine an MFA setup even when the second factor is configured.
Matters or hype?
Does this story matter, or is it hype? Vote before you see what everyone else said.