SonicWall has released a crucial patch for a vulnerability in its SonicOS operating system that potentially allowed attackers to bypass multi-factor authentication in SSL VPNs. The vulnerability, identified as CVE-2026-19868, affects the SSL VPN component of SonicOS, which is integral to SonicWall firewalls. This issue was one of seven vulnerabilities outlined in an advisory published on November 6. The vulnerability specifically impacts systems using SAML-based login and has been assigned a CVSS score of 7.1, categorizing it as high severity. Ryan Harris from The Electronic Office reported the flaw, and SonicWall's security team has acknowledged potential exploitation of this issue.
The Cybersecurity and Infrastructure Security Agency (CISA) added this vulnerability to its Known Exploited Vulnerabilities catalog. Per federal mandates, agencies must address this flaw by November 20. Although details about any attacks exploiting this vulnerability remain undisclosed, SonicWall urges customers to upgrade to SonicOS versions 7.3.4-7013 and 8.2.3-8015, as no alternative measures exist. The affected devices include Gen7 TZ, NSa, NSsp, and NSv firewalls with SonicOS 7.3.3-7015 or earlier, as well as Gen8 TZ, NSa, and NSv firewalls with SonicOS 8.2.2-8015 or earlier.
While none of the other six vulnerabilities in SonicWall's advisory have been marked as exploited, two have a CVSS score of 8.8 and affect the SonicOS management interface. These vulnerabilities could potentially allow remote attackers to perform unauthorized actions without needing to log in. Additionally, three pre-authentication buffer overflow vulnerabilities in the SSL VPN service and TACACS+ authentication client could enable denial-of-service attacks, and a weak password hashing issue in virtual appliances could be exploited by attackers with high-privileged local access. SonicWall has a history of vulnerabilities being targeted by threat actors, and the rapid response to this current threat underlines the importance of timely patch management.
