CISAAnalysisCISA adds SonicWall SonicOS SSLVPN bypass zero-day to KEV catalog
What happened.The Cybersecurity and Infrastructure Security Agency added an actively exploited SonicWall SonicOS SSLVPN authentication bypass vulnerability to its Known Exploited Vulnerabilities catalog.
Why it matters.Perimeter firewalls terminate remote tunnels and enforce access controls. When single-factor bypasses disable SAML multifactor authentication, stolen secondary credentials grant access to internal corporate networks. Incident response teams must audit SSLVPN session logs for irregular access patterns. Security administrators should apply updated SonicOS firmware and isolate management interfaces.
The technical specifications:
- Vulnerability mechanics: Tracked as CVE-2026-19868, the flaw involves improper single-factor authentication checks when processing alternate credentials on Gen 7 and Gen 8 firewalls.
- MFA bypass vector: Attackers with valid credentials for secondary accounts can bypass SAML controls, evading multi-factor authentication policies.
- Observed exploitation: SonicWall PSIRT and federal telemetry observed active exploitation campaigns targeting public-facing SSLVPN interfaces to establish network access.
- Federal directive: Under Binding Operational Directive 26-04, CISA mandated federal civilian agencies apply vendor updates by November 20, 2026 or disconnect affected appliances.
- Remediation releases: SonicWall published SonicOS 7.3.4-7013 for Gen 7 platforms and SonicOS 8.2.3-8015 for Gen 8 devices to neutralize the authentication flaw.