Attackers are exploiting a flaw in SonicWall firewalls that can let them get past single sign-on and multifactor authentication (MFA) protecting remote access to corporate networks, the Cybersecurity and Infrastructure Security Agency (CISA) said Friday. SonicWall says there is no workaround, so organizations that count on that login step at the network edge are protected only once they upgrade, BleepingComputer reported Friday.
What Happened
In an alert, CISA added the flaw, tracked as CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, its list of bugs with evidence of real-world attacks. It was the only addition that day. The catalog lists ransomware use as unknown and gives federal civilian agencies until Nov. 20 to fix it.
The bug sits in the SSL VPN service of SonicOS, the operating software on SonicWall firewalls. An SSL VPN is a virtual private network that lets employees connect to the office network over an encrypted web connection. Many companies put that login behind SAML (Security Assertion Markup Language), a standard that hands sign-in to a central identity provider, which in turn enforces MFA, the second step such as a phone prompt or code.
According to CISA's catalog entry, a user with valid credentials for an alternate authentication method can bypass the SAML controls, which may also bypass MFA enforced through SAML. In plain terms, a working password for another sign-in route on the same firewall can be enough to skip the step a company relies on. SonicWall says only SSL VPN services configured for SAML are exposed, SecurityWeek reported.
SonicWall rates the flaw 7.1 out of 10, or high, on the Common Vulnerability Scoring System. In its advisory, SNWLID-2026-0014, SonicWall said its product security team investigated a report indicating potential exploitation and urged customers to upgrade as soon as possible, according to BleepingComputer and SecurityWeek. The affected firewalls are the seventh- and eighth-generation TZ, NSa and NSv lines, plus seventh-generation NSsp units, and SonicWall has released fixed software for both generations.
The same advisory fixes six other flaws not marked as exploited, including two rated 8.8 in the management interface that BleepingComputer said could be abused without logging in under certain conditions.
Why It Matters
Stolen and reused passwords are plentiful, and MFA is often the control that keeps them from opening a network. For a company whose remote workforce reaches internal systems through a SonicWall VPN, this flaw can turn a leaked password into a working session without the second check executives assume is in place. With no workaround, the decision for leaders is how fast the upgrade happens.
CISA's catalog entry does not require agencies to run forensic checks for this flaw, but checking is still prudent. Organizations can install the update, review VPN logs for sessions from unfamiliar locations or accounts that skipped the usual sign-in, and, where something looks wrong, end active sessions and reset the affected credentials.
Context
SonicWall equipment has been a frequent target this year. The Primary Wire reported in October on a maximum-severity flaw in the company's separate SMA1000 remote-access gateways; BleepingComputer said attackers later tried to exploit it, after zero-day attacks on that product line in July and September. U.S., German and UK agencies also listed an older SonicOS flaw among those the SafePay ransomware group exploits, The Primary Wire reported in October.
What to Watch
Whether SonicWall, CISA or security researchers describe the attacks, and whether the flaw was used before the fix shipped, which SecurityWeek said is unclear. Neither has said who is responsible or how many organizations were affected. The federal deadline is Nov. 20.
