Attackers Can Bypass Your SonicWall Firewall's MFA

A critical flaw in SonicWall firewalls that lets attackers bypass MFA is now being actively exploited, according to a new US government alert.

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a critical warning by adding a SonicWall vulnerability to its Known Exploited Vulnerabilities (KEV) catalog. This move signals that the agency has credible evidence of the flaw being actively used in real-world attacks. The vulnerability, identified as CVE-2026-19868, affects SonicWall's SonicOS, the operating system that powers its popular line of firewalls. According to reporting from The Hacker News, this action follows reports suggesting the flaw was being exploited before it was officially added to the list, raising the urgency for organizations to respond. The vulnerability carries a high-severity CVSS score, underscoring the potential damage an attacker could inflict. CISA’s KEV catalog serves as a directive for federal agencies to patch listed vulnerabilities within a specific timeframe, and a strong recommendation for all other organizations to do the same.

The vulnerability is described as a flaw in the authentication reinforcement mechanism of SonicOS. In practical terms, this means an attacker can bypass the multi-factor authentication (MFA) protections on the device. MFA is a foundational security layer designed to protect accounts even if a password is stolen, requiring a second form of verification like a code from a mobile app. A flaw that allows an attacker to sidestep this check is exceptionally dangerous. It effectively reduces the security of a highly protected system to just a single, potentially compromised password. While the exact technical method of the bypass has not been fully detailed in the initial reports, the impact is clear: an unauthorized user could gain administrative access to the firewall, and by extension, the network it protects. This type of vulnerability turns a critical piece of security infrastructure into a gateway for attackers.

This incident highlights a persistent and dangerous trend in cybersecurity where attackers increasingly target network edge devices like firewalls and VPN concentrators. These appliances are the gatekeepers to corporate networks, making them high-value targets. Because they sit on the perimeter of the network, they are directly exposed to the internet, giving attackers a constant opportunity to probe for weaknesses. In recent years, similar vulnerabilities in devices from Fortinet, Ivanti, and Cisco have led to widespread security incidents and major data breaches. Attackers know that compromising a single firewall can provide them with a foothold to move laterally across an entire internal network. The addition of this SonicWall flaw to the CISA KEV catalog places it in the company of other critical perimeter security bugs that have been weaponized by both cybercriminals and nation-state actors.

The immediate takeaway for any organization using SonicWall firewalls is to treat this as a top-priority security event. The "known exploited" designation from CISA is not a theoretical warning; it is a confirmation that this vulnerability is being used by attackers right now. IT and security teams must immediately begin the process of identifying all vulnerable devices within their environment and applying the necessary patches released by SonicWall. Beyond patching, this is a moment to review security monitoring and logging practices. Teams should be looking for any anomalous authentication attempts against their firewalls that may indicate a past or ongoing compromise. In the longer term, this event serves as a reminder that no single security control, not even MFA, is infallible. A defense-in-depth strategy, which assumes that any individual layer of security can fail, remains the most resilient approach to protecting critical assets.

MFA is a cornerstone of modern security. A bypass vulnerability in a widely used perimeter security device like a SonicWall firewall is a critical failure. It means attackers can gain access to protected networks even if credentials are stolen, completely negating a key security layer.

This vulnerability exposes businesses using affected SonicWall devices to significant risk of data breaches, ransomware, and operational disruption. A successful exploit could lead to substantial financial losses from incident response, regulatory fines, and reputational damage.