The Cybersecurity and Infrastructure Security Agency (CISA) on Nov. 6 added a multi-factor authentication (MFA) bypass bug affecting SonicWall SonicOS to it known exploited vulnerabilities (KEV) list.
The high-severity flaw — CVE-2026-19868 — could let a user with valid credentials for an alternate authentication method bypass security assertion markup language (SAML) authentication, including SAML-enforced MFA.
Nicholas Franklin, senior solutions architect at Xage Security said, the SonicWall SonicOS vulnerability demonstrated why organizations cannot rely on MFA alone to protect their networks. In this case, attackers with valid credentials for an alternate authentication method can bypass MFA and gain unauthorized remote access.
Franklin explained that an MFA bypass flaw lets attackers circumvent additional identity verification that would normally prevent someone with a stolen password from gaining access. MFA represents one of the most important defenses against compromised credentials and uses biometric data or a code from an authenticator app to make logins and access more secure: but nothing offers a security guarantee and even MFA can be vulnerable.
The danger with the SonicWall vulnerability is what happens next, said Franklin. If MFA only gets enforced at the network perimeter, a single successful bypass could give attackers access to sensitive systems and let them move deeper into an organization's environment.
“From real-world examples, we have seen how techniques such as MFA fatigue and SIM swapping can undermine authentication defenses in major cyberattacks,” said Franklin.
Organizations should patch the SonicWall vulnerability, but they also need to recognize that no single security measure is foolproof: patching alone does not suffice. Franklin said teams need to make MFA part of a broader zero-trust strategy that continuously verifies identities, enforces granular access controls, and limits how far an attacker can move, even after successfully logging in. The goal: prevent one compromised account or authentication failure from escalating into a much larger security incident.
Andi Ursry, threat intelligence analyst at Blackpoint Cyber, said MFA bypass flaws offer a way for attackers to sign-in without completing a second verification step. In this case, someone with valid credentials for another login method could bypass the checks that an organization’s identity provider normally enforces on the SonicWall SSL VPN: that means stolen credentials could let an attacker onto the network without ever triggering an MFA prompt.
“What they can reach depends on the VPN account’s permissions, but even limited access can give them a foothold to look for internal systems and move deeper into the network,” Ursry said.
Security teams should prioritize SonicWall’s firmware update on affected firewalls and restrict or temporarily disable SSL VPN access where they can’t patch immediately, said Ursry. Additionally, security teams should monitor the accounts that connect through the VPN for signs of lateral movement, such as remote logins to internal systems those accounts rarely or never access: they should also compare successful VPN logins from before the update with their identity provider’s sign-in records.
Seemant Sehgal, chief executive officer at BreachLock, said MFA only protects a company if every path into the login flow enforces it, and this flaw appears to show that a second authentication method on the same SSL VPN service can sidestep the SAML check entirely. In that case, Sehgal said an attacker holding valid credentials for that alternative method gets in without an MFA prompt, so organizations using MFA to manage remote access are still at risk.
“The right thing to do now is patch the SonicOS instances, inventory every authentication method still enabled on those gateways, and review VPN logs for sessions that never passed through SAML, because attackers are already testing which of those paths nobody remembered to turn off,” explained Sehgal.
Jason Soroko, senior fellow at Sectigo, said MFA asks a person to prove who they are in two ways: usually something they know, such as a password, and something they have, such as a phone that receives or generates a code. The thinking is that a thief who steals one will not have the other.
Soroko explained than an MFA bypass undoes that protection: sometimes it finds a route into the account where the second check is never requested, such as an older login method, an account recovery process, or a misconfigured setting. Sometimes it defeats the check directly.
Malware on a compromised laptop or phone can capture a one-time code as the user enters it and pass it to an attacker, who uses it before it expires, said Soroko. Both attacks rely on the same weakness: passwords and one-time codes are shared secrets, the user and the system both hold the value, so anyone who intercepts it can use it.
“Layering a second shared secret on top of the first gives an attacker two things to steal, not a different kind of problem,” said Soroko. “Methods built on public key cryptography, such as passkeys and certificates, remove the shared secret. The private key stays on the device, and nothing that crosses the network can be reused.”
