The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability affecting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog following reports of potential exploitation in real-world attacks. Identified as CVE-2026-19868, the vulnerability affects the SonicOS SSL-VPN service and could allow users with valid credentials for an alternative authentication method to bypass Security Assertion Markup Language (SAML) authentication controls. Successful exploitation may also circumvent multi-factor authentication (MFA) enforced through SAML, potentially weakening an important security layer used to protect remote network access. CISA added the vulnerability to its KEV catalog on November 6, 2026, indicating that it meets the agency’s criteria for known exploitation. SonicWall has acknowledged investigating a report of potential exploitation and advised customers to install the relevant security updates as soon as possible. According to SonicWall’s security advisory, CVE-2026-19868 involves an authentication enforcement weakness that affects the SSL-VPN service when alternative authentication methods are available. The issue could allow an individual with valid credentials through an alternative method to bypass SAML-based authentication requirements, including MFA controls configured through SAML. The vulnerability carries a CVSS score of 7.1 according to SonicWall, while the CISA enrichment record lists a score of 7.5. Both assessments classify it as high severity, with the difference reflecting variations in the scoring assessment. The company has not disclosed further details about the reported exploitation, including the identity of any threat actors, affected organisations or the number of potentially impacted systems. The addition to CISA’s KEV catalog nevertheless places the vulnerability among security issues that require attention from organisations using affected SonicOS deployments.
SonicWall also addressed several other high-severity vulnerabilities affecting SonicOS. These include CVE-2026-107155, with a CVSS score of 8.8, involving a permissive cross-domain policy weakness in the management interface that could potentially allow remote unauthenticated attackers to perform unauthorised operations under specific conditions. CVE-2026-107154, also rated 8.8, concerns session validation in the SonicOS management interface and could similarly enable unauthorised operations under certain circumstances. Another issue, CVE-2026-82308, carries a CVSS score of 7.5 and involves a pre-authentication heap-based buffer overflow in the SSL-VPN service that could allow a remote unauthenticated attacker to cause an application-level denial-of-service condition. These vulnerabilities were included among the issues addressed through SonicWall’s security updates, making it important for administrators to review the vendor’s advisory and determine whether their deployments are affected.
CISA has set November 20, 2026, as the remediation deadline for Federal Civilian Executive Branch (FCEB) agencies, recommending that they apply the relevant security updates to protect their networks. Organisations using SonicWall products should review the official security guidance, identify affected deployments and install the applicable patched versions. The disclosure follows separate reports concerning two vulnerabilities, CVE-2026-109593 and CVE-2026-109594, affecting SonicWall’s end-of-life Global Management System (GMS). In that case, SonicWall advised customers to move to Network Security Manager (NSM), its newer management platform, rather than expect patches for the discontinued GMS systems. Together, the developments highlight the importance of maintaining supported security products, monitoring vendor advisories and addressing authentication weaknesses that could affect remote access to enterprise networks.
Follow the SPIN IDG WhatsApp Channel for updates across the Smart Pakistan Insights Network covering all of Pakistan’s technology ecosystem.
