An MFA bypass on a firewall management plane is not just another CVE - it removes the one compensating control that stands between a stolen credential and full appliance access. CISA confirmed active exploitation of CVE-2026-19868 in SonicWall SonicOS this week and added it to the Known Exploited Vulnerabilities catalog. Meanwhile, a joint FBI/CISA advisory highlighted a threat vector most organizations have not modeled: remote hijacking of industrial refrigeration controllers in cold-chain logistics. And security researchers demonstrated that two major automakers left default admin:admin credentials on the backend servers that unlock and start customer vehicles.

Three stories, one theme: the controls defenders assume are in place often are not.

In the News

SonicWall MFA Bypass CVE-2026-19868 Added to CISA KEV

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog after confirming active exploitation in the wild. The vulnerability is an authentication bypass in SonicWall SonicOS - specifically, it allows remote attackers to skip multi-factor authentication on firewall management interfaces. CVSS score: 7.5 (HIGH).

The implications are straightforward and serious. SonicWall appliances sit at the perimeter of thousands of enterprise and mid-market networks. The management interface is the administrative control plane - if MFA is bypassed, an attacker with valid or guessed credentials has full administrative access to firewall policy, VPN configuration, and network routing. Federal agencies are now on a mandatory patching timeline under Binding Operational Directive 22-01. Every organization running SonicWall should treat this with the same urgency.

The MITRE ATT&CK mapping here is T1556 - Modify Authentication Process. Threat actors exploiting this flaw are not breaking authentication - they are walking around it. The distinction matters because detection strategies that focus on brute-force or credential-stuffing patterns will miss this entirely.

What defenders should do: Patch SonicOS to the version specified in the SonicWall advisory immediately. If patching requires a maintenance window, restrict management interface access to a dedicated out-of-band management VLAN - do not leave the management plane reachable from untrusted networks. Audit VPN and administrative access logs for any authentication events that bypassed the expected MFA challenge.

FBI and CISA Warn of Remote Hijacking of Refrigeration Controllers

A joint FBI/CISA advisory warned that threat actors are remotely compromising industrial refrigeration controllers used in cold-chain logistics - pharmaceutical storage facilities, food distribution centers, and blood banks. The attack surface: internet-exposed controllers running default credentials with no network segmentation separating them from enterprise IT networks.

Successful exploitation allows attackers to manipulate temperature set points. The consequences are physical, not just digital: overloaded compressors can cause fires, and temperature excursions spoil pharmaceutically regulated inventory - vaccines, biologics, blood products - with direct patient safety implications. This is OT security with life-safety stakes.

The advisory maps to MITRE ATT&CK for ICS - T0836 (Modify Parameter) and highlights a pattern defenders have seen repeatedly: OT devices deployed on flat networks, accessible from the internet, running with factory-default credentials. The fix is not novel - segment OT networks, enforce credential rotation, and deploy OT-specific network monitoring - but the advisory confirms that threat actors are actively targeting this specific category of device.

What defenders should do: Inventory all internet-exposed OT devices, particularly refrigeration and HVAC controllers. Remove direct internet exposure immediately. Enforce network segmentation between IT and OT zones. Rotate default credentials on all industrial control devices and implement network access control to restrict which systems can communicate with OT controllers.

Default admin:admin Credentials Let Researchers Unlock Cars Remotely

Security researchers disclosed that two major automakers’ connected-vehicle backend servers were running with default admin:admin credentials on the identity platform powering their mobile apps. The result: remote unlock, engine start, and real-time location tracking of customer vehicles - all without any authentication challenge beyond the default password.

The vulnerability was not in the vehicles or the mobile apps. It was in the backend identity platform - the ForgeRock/Ping Identity-class server that brokers OAuth tokens between the app and the vehicle API. A single compromised server exposed the entire fleet. Both manufacturers have since rotated credentials and hardened access controls.

This is a credential hygiene story, not a connected-car story. Every organization running third-party identity platforms for API authentication - fleet management, logistics, IoT device management - should audit administrative interfaces for default credentials. The MITRE ATT&CK mapping is T1078.001 - Valid Accounts: Default Accounts.

What defenders should do: Audit all identity platform administrative interfaces for default credentials. Enforce MFA on every administrative login. Implement privileged access management policies that prevent default credentials from persisting past initial deployment.

Defender Action Items

  • Patch SonicWall SonicOS immediately for CVE-2026-19868. If a maintenance window is required, restrict management interface access to an out-of-band VLAN and audit logs for MFA bypass indicators.
  • Inventory internet-exposed OT devices - refrigeration controllers, HVAC systems, building management systems. Remove direct internet exposure and segment OT networks from IT networks per the FBI/CISA advisory.
  • Audit identity platform admin interfaces for default credentials. Enforce MFA and credential rotation policies on all OAuth/SAML broker administrative consoles.
  • Review RSA key lengths in your PKI stack. Google DeepMind’s published research on AI-assisted RSA-1024 factoring means legacy 1024-bit keys are on an accelerating deprecation curve. Begin migration planning to 2048-bit minimum.

Detection Queries

SonicWall management interface access events that bypass MFA are the primary detection signal for CVE-2026-19868 exploitation. If your SonicWall appliances forward syslog to a SIEM, look for successful administrative authentication events that lack the expected MFA completion marker. The exact field names depend on your SonicOS version and syslog format, but the logic below applies to Splunk environments ingesting SonicWall syslog data:

index=firewall sourcetype="sonicwall:syslog"
  event_type="Admin Login"
  result="Success"
| where isnull(mfa_method) OR mfa_method=""
| stats count by src_ip, user, _time
| where count > 0

This query surfaces successful administrative logins where the MFA method field is null or empty - the signature of an authentication bypass. False positive rate is low in environments where MFA is enforced on all admin accounts; any hit warrants immediate investigation. Adjust mfa_method to match your specific SonicWall syslog field mapping.

For OT environments responding to the refrigeration controller advisory, monitor for anomalous Modbus or BACnet traffic from unexpected source IPs:

index=ot_network sourcetype="zeek:modbus" OR sourcetype="zeek:bacnet"
| where NOT cidrmatch("10.100.0.0/16", id.orig_h)
| stats count by id.orig_h, id.resp_h, function_code
| sort -count

Replace 10.100.0.0/16 with your OT management subnet. Any Modbus or BACnet traffic originating from outside the expected OT management range is anomalous and should be investigated.

References

Subscribe to it-learn Brief

Get it-learn Brief in your inbox (Mon–Fri) - Daily cybersecurity news, SE angles, and detection queries.