SonicWall VPN MFA Bypass Hits CISA's Exploited List — Patch Your Edge Gateways Now

CISA adds SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 to its exploited list; plus an 18-year-old WordPress core bug being used in attacks.

CISA added CVE-2026-19868, an SSL-VPN authentication weakness in SonicWall SonicOS, to its Known Exploited Vulnerabilities catalog on 6 November, citing evidence of active exploitation.
Affected organizations are anyone exposing SonicOS SSL-VPN portals to the internet — including school districts and government agencies that rely on VPN plus MFA for remote staff access.
An attacker holding valid credentials for a different login method may bypass SAML checks, including SAML-enforced MFA, so a phished password could be enough to get inside the network; SonicWall has released fixes as part of a seven-vulnerability update.

What to do now

Inventory every SonicWall SonicOS appliance that terminates VPN or participates in SAML authentication; record firmware build, ownership and whether the SSL-VPN portal is reachable from the internet.
Apply the SonicWall fixed release for CVE-2026-19868 immediately via emergency change approval, starting with internet-facing gateways, HA pairs and remote-site units; confirm the build number after rebooting rather than assuming the update applied.
If patching must wait, cut exposure now: restrict SSL-VPN and management access to trusted source IP ranges or required user groups, and disable unused portals and legacy login methods.
Hunt in VPN and SAML logs for successful sign-ins that skipped MFA prompts, used unexpected assertions, came from new geographies, or show unusual session lengths or lateral access; preserve evidence before cleanup.
After patching, test SAML validation and MFA enforcement with representative accounts, revoke active VPN sessions, rotate credentials for any suspicious accounts, and confirm no new local administrator accounts or configuration changes were added to the appliance.