CISA has put a SonicWall flaw on its list of bugs that attackers are known to use. CISA's alert says the entry, CVE-2026-19868, is a weakness in SonicOS SSLVPN tied to single-factor sign-in.
The risk centers on login protection. CISA's catalog entry says a person who already holds valid credentials for a different sign-in method may be able to get around SAML controls, including multi-factor authentication enforced through SAML. Federal civilian agencies have a deadline of Nov. 20, and CISA urges other organizations to treat flaws like this one as a priority.
Key facts
- CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 2026-11-06, with a due date of 2026-11-20.
- The flaw may let a user with working credentials for another sign-in method skip SAML checks and SAML-enforced MFA, according to the catalog entry.
- NVD lists a CVSS v3.1 score of 7.5, rated HIGH, and a CWE-308 classification supplied by SonicWall.
- The catalog lists known use in ransomware campaigns as unknown.
- CISA's required action is to follow the vendor's mitigation steps, or stop using the product when no mitigation exists.
Background
CISA keeps the Known Exploited Vulnerabilities catalog, often called KEV, as its list of flaws known to be exploited. In its alert on the new entry, the agency says this kind of weakness is a common route in for malicious cyber actors.
The SonicWall entry describes a problem with how users sign in. The catalog entry says the flaw may let someone with valid credentials for an alternate method of signing in bypass those SAML controls. The same entry says a successful attack may also defeat MFA that SAML enforces.
That matters because MFA is meant to add a check beyond a password. If a valid credential for another login path is enough to step around SAML, the second factor may not do its job.
NVD lists a CVSS v3.1 base score of 7.5, rated HIGH, from a secondary assessment rather than NVD's own analysis. The record also carries a CWE-308 classification from SonicWall.
For vendor guidance, the KEV entry links SonicWall advisory SNWLID-2026-0014. Administrators should read that advisory directly for product details.
The federal deadline comes from a binding operational directive. BOD 26-04 tells federal agencies to fix each listed flaw as fast as they can, and no later than the timelines set out in its Table 1. CISA says BOD 26-04 replaces and revokes BOD 19-02.
What it means for you
The directive itself does not bind private companies. CISA's alert notes that BOD 26-04 covers only Federal Civilian Executive Branch agencies, but the agency encourages every organization to make fixing KEV flaws a priority.
For a business that runs SonicWall SSLVPN with SAML sign-in, the practical concern is trust in the login process. Teams that count on MFA to block stolen passwords should not assume that protection holds on an affected system until the vendor guidance has been applied.
CISA's advice for small businesses is to put critical vulnerabilities first, especially on systems that face the public, and to use the KEV catalog to decide what comes first. A remote access gateway that can be reached from the internet fits that public-facing group.
Small teams often struggle to track which devices need attention and in what order. A cybersecurity program can help sort urgent fixes from routine ones. A managed IT service can take on the patching and follow-up work when staff time is short. For a closer look at how risk-based deadlines work, see this guide to risk-based patch deadlines.
Practical steps
- Find out whether the organization uses SonicOS SSLVPN, and whether that remote access relies on SAML for sign-in and MFA.
- Open the vendor guidance that the KEV entry links, advisory SNWLID-2026-0014, and follow its instructions for the product in use.
- Apply the vendor's mitigations, which is the action CISA requires of federal agencies. If no mitigation is available, CISA's instruction is to stop using the product.
- Review which users hold credentials for sign-in methods other than SAML, since the flaw involves those credentials.
- Treat the federal date of Nov. 20 as a useful target, even for organizations outside the federal government.
- Check for hardware or software that has reached end of life, because CISA advises replacing it once security updates stop.
A plan for backups and recovery is also worth a look when remote access is at risk. A disaster recovery plan can help a business keep working if a key system has to be taken offline.
What happens next
Federal civilian agencies must act on the flaw by Nov. 20. CISA's BOD 26-04 directive says agencies should move as quickly as possible and stay within its Table 1 timelines.
For now, the catalog lists ransomware use as unknown. Security teams can keep watching the KEV entry and the linked vendor advisory for any changes.
