US agency warns of a flaw that lets attackers skip a login check

The US Cybersecurity and Infrastructure Security Agency (CISA) has added a SonicWall flaw to its list of vulnerabilities known to be used in real attacks. The flaw affects SonicOS, the software that runs SonicWall network devices. It could let someone slip past the extra login step that is meant to protect remote access.

What changed

The flaw is tracked as CVE-2026-19868 and rated high severity, with scores of 7.1 and 7.5. It sits in the SSL-VPN service, which lets people connect to a company network from outside the office. SonicWall says a person who has valid credentials for an alternate sign-in method may bypass SAML controls. SAML is a system that lets a company confirm who you are through one central login. The bypass may also skip multi-factor authentication (MFA), the second check, such as a code, that proves it is really you.

SonicWall said it investigated a report of possible exploitation and urged customers to update as soon as possible. It has not shared details of any attack or who is behind it. It also patched several other high-severity flaws.

Who it affects

The risk is for organizations using SonicOS with SSL-VPN and SAML sign-in. Federal agencies must apply the fix by November 20, 2026. Separately, SonicWall recently detailed two unpatched flaws in old Global Management System (GMS) products that no longer get support. It urged those customers to move to Network Security Manager.

What to do

The alert box above lists the steps. The main one is to update SonicOS and ask your IT provider whether your setup is affected. Still unknown: how widely the flaw has been used and who is using it.