The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks.
The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 / 7.5), has been described as an authentication reinforcement vulnerability via alternate authentication methods.
“An authentication enforcement vulnerability in SonicOS SSL-VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA),” SonicWall said in a Friday advisory.
The company also acknowledged that it “investigated a report indicating potential exploitation of this vulnerability,” urging customers to update to the latest version as soon as possible. SonicWall did not disclose any additional specifics about the nature of the attack or who is behind the effort.
Also patched by SonicWall are a number of other high-severity flaws –
- CVE-2026-107155 (CVSS score: 8.8) – A permissive cross-domain policy vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions.
- CVE-2026-107154 (CVSS score: 8.8) – A session validation vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations under specific conditions.
- CVE-2026-82308 (CVSS score: 7.5) – A pre-authentication heap-based buffer overflow vulnerability in the SonicOS SSL-VPN service that could potentially enable a remote unauthenticated attacker to cause an application level denial-of-service.
Federal Civilian Executive Branch (FCEB) agencies are recommended to apply the patches by November 20, 2026, to secure their networks against the threat.
The development comes days after SonicWall detailed two unpatched vulnerabilities impacting end-of-life Global Management System (GMS) systems (CVE-2026-109593 and CVE-2026-109594), urging customers to upgrade to Network Security Manager (NSM).
