[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMQ3qyhjIdUBaB7PTL6yp4jv7dWWbCq0uKzUsWW_laCU":3},{"article":4,"iocs":55,"watch_terms":74,"solutions":75,"lesson":166},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":32,"category":33,"article_tags":37},"6aafae59-bb37-451a-8b7e-3ff8d8c89f78","CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation","cisa-flags-sonicwall-sonicos-mfa-bypass-flaw-amid-reports-of-possible-exploitati-4d02c2","The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added a high-severity vulnerability impacting SonicWall SonicOS to its Known Exploited Vulnerabilities (KEV) catalog, following reports that it said may have been exploited in real-world attacks. The vulnerability, tracked as CVE-2026-19868 (CVSS score: 7.1 \u002F 7.5), has been described as an authentication reinforcement","CISA has added a critical SonicWall SonicOS vulnerability (CVE-2026-19868) to its Known Exploited Vulnerabilities catalog due to potential real-world exploitation. The flaw allows bypassing SAML authentication and MFA for users with valid credentials via alternate methods. SonicWall urges customers to update immediately, while CISA recommends federal agencies apply patches by November 20, 2026.","CISA adds SonicWall SonicOS MFA bypass flaw to KEV catalog amid exploitation reports.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F11\u002Fcisa-flags-sonicwall-sonicos-mfa-bypass.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEjILYvlBWd-cPdnYJiX5gpFUBvDeq0nZYHWard5V4B8oEx7r_-4lUxcIan0_5l4EHxun-KbEHOJTj1p8qTuORzAaKalwqmlz1ajVuBmS-KTBJB0-rBSrhHGgHUkY0I3GTMSEbIy5fkP4vDyITtkZvbkqreMTACQjDS3OBRmnZE4U7pVZLjgId53L259b5Qj\u002Fs1600\u002Fsonicss.jpg","2026-11-09T06:05:24+00:00","2026-11-09T07:00:31.534107+00:00",8,[17,20,23,25,27,30],{"name":18,"type":19},"SonicOS","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":19},"Global Management System (GMS)",{"name":26,"type":19},"Network Security Manager (NSM)",{"name":28,"type":29},"MFA","technology",{"name":31,"type":29},"SAML","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":32,"icon":34,"name":35,"slug":36},null,"Vulnerabilities","vulnerabilities",[38,43,48,50],{"category":39},{"id":40,"icon":34,"name":41,"slug":42},"2c8f44d4-b56e-47cf-9677-04f22c9ee78d","Identity & Access","identity-access",{"category":44},{"id":45,"icon":34,"name":46,"slug":47},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":49},{"id":32,"icon":34,"name":35,"slug":36},{"category":51},{"id":52,"icon":34,"name":53,"slug":54},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[56,60,63,66,69,72],{"type":57,"value":58,"context":59},"cve","CVE-2026-19868","SonicWall SonicOS MFA bypass vulnerability",{"type":57,"value":61,"context":62},"CVE-2026-107155","SonicOS management interface permissive cross-domain policy vulnerability",{"type":57,"value":64,"context":65},"CVE-2026-107154","SonicOS management interface session validation vulnerability",{"type":57,"value":67,"context":68},"CVE-2026-82308","SonicOS SSL-VPN heap-based buffer overflow vulnerability",{"type":57,"value":70,"context":71},"CVE-2026-109593","End-of-life SonicWall Global Management System (GMS) vulnerability",{"type":57,"value":73,"context":71},"CVE-2026-109594",[21,18,24],{"controls":76,"vendors":160},[77,106,135],{"slug":78,"name":79,"problem":80,"products":81},"phishing-resistant-mfa","Phishing-resistant MFA","A stolen password, or a user who taps Approve on a push prompt, is no longer enough to log in.",[82,90,98],{"vendor_slug":83,"vendor_name":84,"vendor_logo":85,"product_slug":86,"product_name":87,"url":88,"description":89},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","entra-id","Microsoft Entra ID","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fidentity-access\u002Fmicrosoft-entra-id","Cloud identity and access management with single sign-on, conditional access, passkeys and identity governance.",{"vendor_slug":91,"vendor_name":92,"vendor_logo":93,"product_slug":94,"product_name":95,"url":96,"description":97},"yubico","Yubico","\u002Fvendor-logos\u002Fyubico.png","yubikey","YubiKey","https:\u002F\u002Fwww.yubico.com\u002Fproducts\u002F","Hardware security keys for FIDO2, passkeys and smart card login, in USB and NFC versions.",{"vendor_slug":99,"vendor_name":100,"vendor_logo":101,"product_slug":102,"product_name":103,"url":104,"description":105},"cisco","Cisco","\u002Fvendor-logos\u002Fcisco.png","duo","Cisco Duo","https:\u002F\u002Fduo.com\u002F","MFA and device trust, with support for passkeys and security keys.",{"slug":107,"name":108,"problem":109,"products":110},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":136,"name":137,"problem":138,"products":139},"patch-management","Automated patch management","Known holes get closed in days, not months.",[140,148,152],{"vendor_slug":141,"vendor_name":142,"vendor_logo":143,"product_slug":144,"product_name":145,"url":146,"description":147},"ninjaone","NinjaOne","\u002Fvendor-logos\u002Fninjaone.png","ninjaone-patch-management","NinjaOne Patch Management","https:\u002F\u002Fwww.ninjaone.com\u002Fpatch-management\u002F","Automated patching of operating systems and third-party applications from the cloud.",{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":136,"product_name":149,"url":150,"description":151},"Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":153,"vendor_name":154,"vendor_logo":155,"product_slug":156,"product_name":157,"url":158,"description":159},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",[161],{"slug":162,"name":21,"logo_path":163,"roles":164},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[165],"affected",{"slug":167,"title":168,"body":169,"framework_refs":170,"framework_notes":178},"sonicwall-mfa-bypass-flaw-actively-exploited-due-to-delayed-patching","SonicWall MFA Bypass Flaw Actively Exploited Due to Delayed Patching","A critical vulnerability in SonicWall SonicOS (CVE-2026-19868) allows attackers to bypass SAML-based authentication and MFA using alternate credential paths, undermining a core layer of identity defence. The flaw reached CISA's Known Exploited Vulnerabilities catalog, meaning real-world threat actors are likely already taking advantage of unpatched systems. This incident illustrates that MFA alone is not a silver bullet — when the underlying authentication framework contains logic flaws, all downstream security controls built on top of it can be circumvented. Organisations relying on perimeter VPN\u002Ffirewall appliances must treat vendor-issued critical patches with the same urgency as a live incident.",[171,172,173,174,175,176,177],"CIS Control 7: Continuous Vulnerability Management","NIST SP 800-53 SI-2: Flaw Remediation","NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control","ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities","OWASP A06:2021 Vulnerable and Outdated Components","NIS2 Article 21(2)(b)","PCI DSS Requirement 6",{"NIS2 Article 21(2)(b)":179,"PCI DSS Requirement 6":180,"NIST SP 800-53 SI-2: Flaw Remediation":181,"OWASP A06:2021 Vulnerable and Outdated Components":182,"CIS Control 7: Continuous Vulnerability Management":183,"ISO\u002FIEC 27001:2022 A.8.8: Management of technical vulnerabilities":184,"NIST CSF 2.0 PR.AA: Identity Management, Authentication, and Access Control":185},"NIS2 mandates incident handling and vulnerability management for essential and important entities; this active-exploitation scenario triggers both obligations — patch the vulnerability and assess whether a reportable incident has already occurred.","Requirement 6 mandates that organisations protect systems and software from known vulnerabilities through timely patching; any cardholder-data environment using SonicWall devices would be non-compliant until this critical patch is applied.","SI-2 requires organisations to identify, report, and correct information system flaws within defined timeframes; a formal remediation process would have driven patching before CISA escalated the flaw to its KEV catalog.","The vulnerable SonicOS firmware is precisely the type of outdated component OWASP A06 addresses; organisations should track component versions and apply updates as a standard part of their secure development and operations lifecycle.","Regular vulnerability scanning against an up-to-date CVE feed would have flagged CVE-2026-19868 on SonicWall devices immediately upon disclosure, enabling patching well before exploitation began.","A.8.8 requires timely identification and remediation of technical vulnerabilities in deployed systems; adherence would have mandated immediate patching of this critical authentication flaw upon vendor notification.","The bypass directly undermines authentication assurance; PR.AA guidance on implementing and validating robust authentication mechanisms would prompt organisations to verify that SAML\u002FMFA implementations cannot be circumvented via alternate methods."]