CISA adds SonicWall SonicOS CVE-2026-19868 to KEV after MFA bypass reports

The advisory describes a path where valid credentials for one auth method sidestep SAML controls entirely. SonicWall confirmed it investigated one exploitation report but released no IOCs, packet captures, or actor indicators. Three additional high-severity issues were patched in the same cycle: permissive cross-domain policy, session validation bypass, and a pre-auth heap overflow in the VPN service that can trigger denial-of-service.

CISA’s KEV entry signals federal agencies must patch by 20 November 2026. The pattern matches prior SonicWall and competing VPN appliances where management interfaces and SSL-VPN stacks repeatedly yield bypasses once initial access is obtained. End-of-life Global Management System instances remain unpatched and explicitly called out for migration, creating a persistent shadow surface.

Independent verification of active exploitation is absent; CISA’s language stays at “may have been exploited.” No technical attribution data has surfaced, leaving the gap between observed attempts and claimed actor activity unclosed. Organizations running SonicOS should treat the MFA bypass as a reliable entry vector for follow-on operations until telemetry proves otherwise.

Next steps include monitoring for post-patch exploitation spikes and cross-referencing firewall logs against known alternate-authentication attempts. Legacy GMS deployments will continue to draw targeted scans.