SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

SonicWall has patched seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN flaw that lets attackers with credentials for an alternate authentication method bypass SAML controls, potentially including SAML-enforced MFA. CISA has added the flaw to its Known Exploited Vulnerabilities catalog and ordered federal agencies to patch by November 20; the release also fixes two management-interface flaws rated 8.8. No workarounds are available.