What Happened
CISA added a SonicWall SonicOS MFA bypass to its Known Exploited Vulnerabilities catalog on November 6, The Hacker News reports. CVE-2026-19868 sits in the SSL-VPN authentication enforcement code. A user with valid credentials for an alternate login method bypasses SAML controls, including MFA enforced through SAML. The flaw carries a CVSS score of 7.1 to 7.5, depending on the listing.
SonicWall investigated a report of possible exploitation and gave no details on the attack or the actors. Federal civilian agencies in the US must patch by November 20, 2026. SonicWall also patched CVE-2026-107155 and CVE-2026-107154, both rated 8.8 in the management interface, and CVE-2026-82308, a pre-authentication heap overflow in SSL-VPN.
Why This Matters for Canadian Organizations
SonicWall firewalls protect many Canadian small businesses, clinics, municipalities, and school boards, often managed by a local provider. Those teams count on SAML MFA as the main barrier to VPN access. This flaw removes the barrier for anyone holding stolen credentials, and infostealer logs supply those daily.
A VPN login without working MFA reaches the internal network. For organizations covered by PIPEDA, an intrusion through a known exploited flaw is hard to defend if a patch sat available. Canada has no KEV deadline of its own, so US dates are the best signal of urgency.
What to Do
Update SonicOS to the latest release listed in the SonicWall advisory. Ask your managed provider to confirm the patch date in writing. Review SSL-VPN logs for logins using alternate authentication methods or odd source addresses since mid-October. Reset passwords for any account with suspicious activity. Disable alternate login methods you do not use. Read more TechTalk coverage and our latest news.
