SonicWall patches exploited flaw that weakens VPN logins

SonicWall has released patches for SonicOS to fix a vulnerability, CVE-2026-19868, that could let attackers with credentials for an alternative login method bypass SAML authentication checks and potentially defeat SAML-enforced MFA. The flaw affects the SSL VPN component of SonicOS, the operating system used by SonicWall firewalls, and is described by SonicWall as an authentication enforcement vulnerability in the SSLVPN service. The CVSS score is 7.1 (high). The vulnerability was reported by Ryan Harris of The Electronic Office, and a report indicates there was potential exploitation of this issue.

SonicWall’s advisory notes that the SSL VPN exposure occurs only when SAML-based login is enabled. Impacted devices include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. The fixes are in SonicOS versions 7.3.4-7013 and 8.2.3-8015; there are no workarounds.

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) list on the day of the advisory, with federal agencies required to address it by 20 November under Binding Operational Directive 26-04. SonicWall states that other vulnerabilities in the advisory have not been exploited, though several are high-severity flaws affecting the SonicOS management interface or pre-authentication conditions. The article notes that the security situation remains under investigation, with limited public detail on active attacks.