CISA Adds SonicWall SonicOS MFA Bypass Flaw to KEV

The US Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning regarding a high-severity vulnerability affecting SonicWall SonicOS, adding the flaw to its authoritative Known Exploited Vulnerabilities (KEV) catalogue. The move follows reports indicating that the vulnerability may have already been exploited in real-world attacks.

Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1 out of 7.5, classifying it as a high-severity issue. It has been described as an authentication reinforcement bypass, allowing attackers to circumvent multi-factor authentication (MFA) in affected SonicWall SonicOS systems.

MFA is a critical security layer designed to verify user identity by requiring more than one method of verification. A bypass vulnerability allows unauthorised actors to gain access to protected systems even if MFA is enabled, significantly increasing the risk of network intrusion and data compromise.

CISA’s inclusion of a vulnerability in its KEV catalogue signifies that it poses a significant risk to federal networks and typically indicates that there is confirmed evidence of active exploitation. While the full extent of reported exploitation remains under investigation, the agency urges all organisations using SonicWall SonicOS to review their deployments and apply any available security updates immediately to mitigate potential threats.