SonicWall has released security updates for seven vulnerabilities in its SonicOS firewall, including a high-severity SSL-VPN authentication bypass flaw that the company says may have been exploited in attacks. Tracked as CVE-2026-19868, the vulnerability can allow attackers with valid credentials for an alternative authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA).
SonicOS authentication bypass vulnerability
CVE-2026-19868 has a CVSS severity score of 7.1 and affects only SonicOS SSL-VPN services configured to use SAML authentication.
In a security advisory released Friday, SonicWall said it had investigated reports that the vulnerability was exploited in attacks and urged customers to install the latest security updates.
“SonicWall PSIRT has investigated reports indicating the potential for exploitation of this vulnerability. Customers are strongly encouraged to upgrade to the latest release as soon as possible to reduce the associated risks,” the company warned.
Ryan Harris of The Electronic Office discovered and reported the vulnerability.
SonicWall has not released details about the reported exploit. However, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) Catalog, confirming that the flaw has been exploited in the wild.
CISA has ordered the federal civilian executive branch to secure affected systems by November 20, 2026.
Additional SonicOS vulnerabilities
The advisory also addresses six other vulnerabilities in SonicOS. Two flaws affect the management interface and have a CVSS severity rating of 8.8. Under certain conditions, they could allow an unauthenticated attacker to perform unauthorized operations.
The remaining vulnerabilities include a pre-authentication buffer overflow affecting SSL-VPN and TACACS+ services that could result in a denial-of-service condition. Another flaw involves weak password hashing in virtual appliances.
Affected SonicOS versions and fixes
The authentication bypass vulnerability affects SonicOS Gen7 versions 7.3.3-7015 and earlier, as well as Gen8 versions 8.2.2-8015 and earlier.
SonicWall fixed the issue in SonicOS Gen7 version 7.3.4-7013 and Gen8 version 8.2.3-8013. The company said no workaround is available, making an upgrade necessary for affected deployments.
Recent attacks against SonicWall appliances
The alert follows a series of attacks targeting SonicWall’s SMA1000 secure remote access appliances.
In October, security researchers detected an exploitation attempt targeting CVE-2026-102255, a maximum-severity vulnerability that could allow an unauthenticated attacker to access internal functionality and perform unauthorized operations.
Those attempts followed a September attack that chained two SMA1000 zero-day vulnerabilities to achieve remote code execution. In July, attackers exploited two other zero-days to deploy malware on vulnerable appliances.
Source: www.bleepingcomputer.com