Skip to content
OriginalSign in
Image: The Hacker News

The Hacker Newsinfo@thehackernews.com (The Hacker News)

SonicWall patches SonicOS flaw that can bypass SAML MFA

Part of the CVE-2026-19868 story · since 6 Nov

Developinglatest 9 hours ago6 articles6 outlets
6 Nov · CISA first8 Nov9 NovNowThis article6th of 6
  • Fri 6 Nov, 20:30 UTC. CISA, first report. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 20:47 UTC. cybersixt, its first report on the story. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 00:30 UTC. SecurityOnline, its first report on the story. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 10:30 UTC. Security Affairs, its first report on the story. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 11:00 UTC. SecurityWeek, its first report on the story. SonicWall patches exploited flaw that weakens VPN logins. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 07:00 UTC. The Hacker News, its first report on the story. SonicWall patches SonicOS flaw that can bypass SAML MFA. Cites a CVE in CISA KEV. This article, 6th of 6.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity flaw in SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog after reports of real‑world activity. The vulnerability, CVE-2026-19868, carries a CVSS of 7.1/7.5 and is described as an authentication enforcement weakness in the SonicOS SSL‑VPN service.

SonicWall’s advisory states that it could allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and that successful exploitation may also defeat SAML‑enforced MFA. SonicWall says it investigated reports of potential exploitation and urges customers to update to the latest software version.

SonicWall also notes the patching of several other high‑severity flaws in SonicOS: CVE-2026-107155 (CVSS 8.8) a permissive cross‑domain policy vulnerability in the management interface; CVE-2026-107154 (CVSS 8.8) a session validation vulnerability in the management interface; and CVE-2026-82308 (CVSS 7.5) a pre‑authentication heap‑based buffer overflow in the SSL‑VPN service that could allow remote unauthenticated denial‑of‑service.

The Federal Civilian Executive Branch (FCEB) agencies are advised to apply patches by 20 November 2026. The report notes SonicWall’s recent communication about unpatched GMS flaws and a recommendation for customers to upgrade to Network Security Manager (NSM). The story attributes findings to SonicWall’s PSIRT and CISA, with mention of ongoing investigation into exploitation activity and a call to patch promptly.

How the story developed

All 6 articles
Developinglatest 9 hours ago6 articles6 outlets

6 articles from 6 outlets since 6 Nov. Still developing; the latest report was 9 hours ago. This was the 6th report, 2 days after the first.

Now6 Nov89First reportCISA · 6 Nov, 20:30This article6th of 6 · day 3
  • Fri 6 Nov, 20:30 UTC. CISA, first report. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue. Cites a CVE in CISA KEV.
  • Fri 6 Nov, 20:47 UTC. cybersixt, its first report on the story. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 00:30 UTC. SecurityOnline, its first report on the story. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 10:30 UTC. Security Affairs, its first report on the story. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog. Cites a CVE in CISA KEV.
  • Sat 7 Nov, 11:00 UTC. SecurityWeek, its first report on the story. SonicWall patches exploited flaw that weakens VPN logins. Cites a CVE in CISA KEV.
  • Mon 9 Nov, 07:00 UTC. The Hacker News, its first report on the story. SonicWall patches SonicOS flaw that can bypass SAML MFA. Cites a CVE in CISA KEV. This article, 6th of 6.
  • Known exploited CVE
  • No CVE
  • Larger: an outlet’s first report
  • Square: official source
  • Coverage over time
Show all 6 articles as a list
  1. Fri 6 NovDay 02
    1. CISA Adds Exploited SonicWall SonicOS Flaw to KEV Catalogue20:30 · CISA · official · First report · CISA alert · Known exploited CVE
    2. SonicWall SSL VPN flaw exploited to bypass SAML and MFA logins20:47 · cybersixt · Known exploited CVE
  2. Sat 7 NovDay 13
    1. Attackers Exploit SonicWall SSLVPN Flaw to Bypass MFA00:30 · SecurityOnline · Known exploited CVE
    2. CISA Adds SonicWall SSLVPN Flaw to Exploited Catalog10:30 · Security Affairs · Known exploited CVE
    3. SonicWall patches exploited flaw that weakens VPN logins11:00 · SecurityWeek · Known exploited CVE

  3. Quiet for 2 days

    Mon 9 NovDay 31
    1. SonicWall patches SonicOS flaw that can bypass SAML MFA07:00 · The Hacker News · Known exploited CVE · This article, 6th of 6

Sources

CyberSIXTSignal over noise
Updated AboutDevelopersSign in