CISA added a vulnerability identified as CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 2026-11-06. The flaw resides in SonicWall SonicOS SSLVPN’s use of single-factor authentication and may let an attacker who has valid credentials for a different authentication method bypass SAML authentication controls. Exploitation could also circumvent SAML-enforced multi-factor authentication. CISA’s notice advises applying mitigations according to the vendor’s instructions and complying with CISA’s BOD 26-04 guidance. 1