The United States Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability affecting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalogue following reports of possible exploitation in real-world cyberattacks.
The security flaw, identified as CVE-2026-19868, carries a severity rating of 7.1/10 and has been classified as an authentication enforcement vulnerability involving alternative authentication methods.
According to SonicWall, the vulnerability affects its SonicOS SSL-VPN service and could allow attackers with valid credentials for an alternative authentication method to bypass Security Assertion Markup Language (SAML) authentication controls.
Successful exploitation could also enable attackers to circumvent multi-factor authentication (MFA) protections enforced through SAML, potentially giving them unauthorised access to protected networks and systems.
In a security advisory published on Friday, SonicWall explained that the weakness could undermine authentication controls when users access the SSL-VPN service through alternative authentication methods.
The company also confirmed that it had investigated a report indicating possible exploitation of the vulnerability.
Although SonicWall did not disclose technical details about the reported attacks or identify the individuals or groups potentially responsible, it urged customers to install the latest security updates as soon as possible.
Additional High-Severity Vulnerabilities Patched
Alongside CVE-2026-19868, SonicWall has released security updates addressing three other high-severity vulnerabilities affecting its SonicOS platform.
The flaws include:
CVE-2026-107155, which carries a CVSS score of 8.8, is a permissive cross-domain policy vulnerability affecting the SonicOS management interface. Under certain conditions, it could allow a remote unauthenticated attacker to carry out unauthorised operations.
CVE-2026-107154, also rated 8.8, is a session validation vulnerability in the SonicOS management interface. The weakness could similarly allow remote attackers without authentication to perform unauthorised actions under specific circumstances.
CVE-2026-82308, which has a CVSS score of 7.5, is a pre-authentication heap-based buffer overflow vulnerability affecting the SonicOS SSL-VPN service. Successful exploitation could enable an unauthenticated remote attacker to trigger an application-level denial-of-service condition.
The vulnerabilities highlight potential security risks affecting network management interfaces and remote access infrastructure, particularly where systems are exposed to external connections.
Federal Agencies Given November 20 Deadline
CISA’s addition of CVE-2026-19868 to its Known Exploited Vulnerabilities catalogue places the flaw among security weaknesses that federal agencies are expected to prioritise for remediation.
Federal Civilian Executive Branch agencies have been advised to apply the available security patches by November 20, 2026, to protect their networks against potential exploitation.
The development comes shortly after SonicWall disclosed two additional vulnerabilities affecting its end-of-life Global Management System (GMS) products.
The two flaws, tracked as CVE-2026-109593 and CVE-2026-109594, remain unpatched because the affected GMS systems have reached the end of their support lifecycle.
SonicWall has advised customers still using the discontinued products to migrate to its Network Security Manager (NSM) platform.
The latest security warnings underscore the importance of promptly updating network security appliances, particularly VPN services and management interfaces that provide access to sensitive corporate infrastructure.