SonicWall Fixes SSL-VPN MFA Bypass Flaw Exploited in Attacks

SonicWall has released security updates for seven vulnerabilities in its SonicOS firewalls, including an SSL-VPN authentication bypass flaw that has been exploited in attacks. The company urged customers to install the latest updates.

Tracked as CVE-2026-19868, the flaw can let attackers with valid credentials for an alternate authentication method bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA). It has a CVSS severity score of 7.1 and affects only SonicOS SSL-VPN services configured to use SAML.

SonicWall said its Product Security Incident Response Team investigated a report of potential exploitation, but did not share details. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities (KEV) catalog. CISA directed federal civilian executive branch agencies to secure affected systems by November 20, 2026. Ryan Harris of The Electronic Office discovered and reported the vulnerability.

The updates also address six other SonicOS vulnerabilities. Two management interface flaws have severity scores of 8.8 and could allow unauthenticated attackers to perform unauthorized operations under specific conditions. Other issues include pre-authentication buffer overflows in SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and weak password hashing in virtual appliances.

The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed them in versions 7.3.4-7013 and 8.2.3-8015. The company says no workarounds are available.