SonicWall has released emergency updates for seven flaws in its SonicOS firewall software, including an SSL-VPN authentication bypass that attackers are already exploiting. The flaw, tracked as CVE-2026-19868, lets an attacker holding valid credentials for an alternate login method bypass SAML authentication controls on the SSL-VPN service, potentially including SAML-enforced multi-factor authentication.

CISA confirms exploitation

The US Cybersecurity and Infrastructure Security Agency has added the flaw to its Known Exploited Vulnerabilities catalogue, confirming it has been exploited in the wild. Federal civilian agencies have been ordered to secure affected systems by 20 November 2026. SonicWall said its product security team investigated a report indicating potential exploitation and urged customers to upgrade as soon as possible.

Who is affected

The flaw only affects SonicOS SSL-VPN services configured to use SAML authentication. It affects SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015, and says no workarounds are available. The vulnerability was discovered and reported by Ryan Harris of The Electronic Office.

Wider patch round

The same advisory fixes six further flaws, including two management-interface flaws rated 8.8 that allow unauthenticated attackers to perform unauthorised operations under specific conditions. The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial of service, and a weak password-hashing flaw affecting virtual appliances.