SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw that the company said may have been exploited in an attack.
The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). It has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication.
In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates. "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," the company said. Ryan Harris of The Electronic Office discovered and reported the vulnerability.
While SonicWall has not shared details about the reported exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that the flaw has been exploited in the wild. CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.
The advisory also fixes six additional vulnerabilities in SonicOS. Two management interface flaws rated 8.8 severity allow unauthenticated attackers to perform unauthorized operations under specific conditions. The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password hashing vulnerability affecting virtual appliances.
The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.
The warning comes after a series of attacks targeting SonicWall's SMA1000 secure remote access appliances. In October, security researchers detected exploitation attempts targeting CVE-2026-102255, a maximum-severity vulnerability that could allow unauthenticated attackers to access internal functionality. Those attempts followed September attacks that chained two SMA1000 zero-days to achieve remote code execution, as well as July attacks that exploited two other zero-days to deploy malware on vulnerable appliances.
Analysis
Why This Matters
- The flaw bypasses SAML-enforced multi-factor authentication, a critical security control for remote access VPNs, making organizations more vulnerable to credential-based attacks.
- CISA's addition to the KEV catalog and its order for federal agencies to patch by Nov 20 indicates active exploitation and a high risk to government and enterprise networks.
- The disclosure follows several months of targeted attacks against SonicWall appliances, suggesting sustained interest from threat actors in these devices.
Background
SonicWall is a major provider of firewall and VPN appliances used by enterprises, government agencies, and small-to-medium businesses worldwide. The company has faced multiple vulnerability disclosures and exploitation attempts against its SMA1000 secure remote access appliances in recent months, including September and July attacks that used zero-day exploits to achieve remote code execution or deploy malware. The latest flaw (CVE-2026-19868) is the first reported against the newer Gen8 SonicOS line.
Key Perspectives
SonicWall: Said it investigated a report of exploitation and is urging customers to upgrade immediately to mitigate associated risks. The company noted that no workarounds are available.
CISA: Added the vulnerability to its Known Exploited Vulnerabilities catalog, confirming wild exploitation, and ordered federal civilian agencies to patch by November 20, 2026.
Ryan Harris (The Electronic Office): Discovered and reported the vulnerability to SonicWall.
What to Watch
- Whether SonicWall releases additional patches for related vulnerabilities in the SMA1000 line or other products.
- The extent of active exploitation beyond the initial attack SonicWall investigated.
- Whether CISA issues additional directives or alerts for other recently disclosed SonicWall flaws.
Checked
12 claims in this story checked against 1 source: 12 supported.
Show each claim
- SupportedSonicWall warned of reported exploitation of an SSL-VPN MFA-bypass flaw.BleepingComputer: “In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack”
- SupportedCISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog.BleepingComputer: “the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog”
- SupportedCISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.BleepingComputer: “CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.”
- SupportedSonicWall released updates fixing seven SonicOS firewall vulnerabilities.BleepingComputer: “SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls”
- SupportedSonicWall said it had investigated a report of possible exploitation and urged customers to upgrade.BleepingComputer: “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks,”
- SupportedCVE-2026-19868 can let attackers with valid credentials for an alternate authentication method bypass SAML controls, potentially including SAML-enforced MFA.BleepingComputer: “allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA).”
- SupportedThe flaw has a CVSS score of 7.1 and affects only SonicOS SSL-VPN services configured to use SAML authentication.BleepingComputer: “The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication.”
- SupportedRyan Harris of The Electronic Office discovered and reported the vulnerability.BleepingComputer: “Ryan Harris of The Electronic Office discovered and reported the vulnerability.”
- SupportedCISA's catalog addition confirms the flaw has been exploited in the wild.BleepingComputer: “CISA has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog , confirming that the flaw has been exploited in the wild.”
- SupportedTwo management-interface flaws rated 8.8 allow unauthenticated attackers to perform unauthorized operations under specific conditions.BleepingComputer: “two management interface flaws rated 8.8 severity that allow unauthenticated attackers to perform unauthorized operations under specific conditions.”
- SupportedThe remaining flaws include pre-authentication buffer overflows in SSL-VPN and TACACS+ that could cause denial-of-service conditions, and a weak password-hashing vulnerability affecting virtual appliances.BleepingComputer: “The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password hashing vulnerability affecting virtual appliances.”
- SupportedThe stated SonicOS versions are affected, the fixes are in versions 7.3.4-7013 and 8.2.3-8015, and no workarounds are available.BleepingComputer: “The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.”
