CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added SonicWall SonicOS SSLVPN flaw CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog. The authentication bypass vulnerability could allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially bypassing SAML-enforced multi-factor authentication (MFA).

The issue arises when the system does not properly enforce SAML authentication controls, meaning that an attacker who already has valid credentials for another authentication method may exploit the weakness to circumvent the SAML-based authentication process.

SonicWall’s PSIRT is investigating reports of possible exploitation, and customers are strongly urged to upgrade to the latest release to reduce risk. The advisory notes that this is not an unauthenticated remote access flaw; the attacker must possess valid credentials for an alternative authentication method in order to bypass SAML security controls.

CISA’s inclusion of CVE-2026-19868 carries a CVSS score of 7.5, and federal agencies are required to address such KEV-listed vulnerabilities under Binding Operational Directive 22-01 by the due date of 20 November 2026. Private organisations are advised to review the KEV catalog and apply necessary mitigations to protect remote access infrastructure.