SonicWall has released updates for seven vulnerabilities in SonicOS, the operating system of its firewalls. One of them, CVE-2026-19868, is an authentication bypass in the SSL-VPN service. BleepingComputer reports that it lets an attacker who holds valid credentials for an alternate authentication method get around SAML authentication controls, which can include MFA enforced through SAML. The flaw has a CVSS score of 7.1 and only affects SSL-VPN set up to use SAML.
SonicWall’s advisory says its PSIRT investigated a report of exploitation and urges customers to upgrade as soon as possible. SonicWall has not shared details of the attack, but CISA has added the flaw to its Known Exploited Vulnerabilities catalog with a deadline of 20 November 2026 for US federal civilian agencies. The same advisory fixes six other flaws: two management-interface issues rated 8.8 that let unauthenticated attackers perform unauthorized operations under specific conditions, pre-authentication buffer overflows in SSL-VPN and TACACS+ that can cause denial of service, and a weak password hashing flaw on virtual appliances.
This is the latest in a run of SonicWall problems. We recently covered attacks on the SMA1000 appliances and SonicWall’s decision not to patch two flaws in end-of-life GMS software. This one concerns the SonicOS firewalls rather than those products.
How to check if you’re affected
Affected products are SonicWall firewalls running SonicOS Gen7 versions 7.3.3-7015 and earlier or Gen8 versions 8.2.2-8015 and earlier, according to BleepingComputer’s reading of the advisory. SonicWall fixed the issues in 7.3.4-7013 and 8.2.3-8015.
- Check which SonicOS version each firewall runs and upgrade to a fixed release. BleepingComputer says SonicWall lists no workarounds.
- The authentication bypass (CVE-2026-19868) only affects SSL-VPN services configured to use SAML authentication. If you use another login method for SSL-VPN, this particular flaw does not apply, but the other six fixes still do.
- Because exploitation has been reported, consider reviewing SSL-VPN logins for sign-ins that did not go through your identity provider. SonicWall has not published indicators, so this is our suggestion rather than vendor guidance.
SonicWall’s advisory page (SNWLID-2026-0014) did not render for our checker, so the version numbers above are taken from BleepingComputer’s report of it; confirm them against the advisory.
Sources
- SonicWall PSIRT advisory SNWLID-2026-0014 (page did not render for our checker; not read directly)
- CISA Known Exploited Vulnerabilities catalog (listing cited by BleepingComputer; page returned 403 to our checker)
- BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks