SonicWall warns of SSL-VPN MFA bypass flaw exploited in attacks

SonicWall issued fixes for seven SonicOS flaws, among them an SSL-VPN authentication bypass that attackers have exploited, the company said in a Friday advisory. Tracked as CVE-2026-19868, the vulnerability scores 7.1 on CVSS and affects SSL-VPN deployments configured for SAML authentication.

An attacker with valid credentials for a different authentication method could bypass SAML controls, potentially including SAML-enforced MFA, SonicWall said. SonicWall's PSIRT investigated a report of possible exploitation. The advisory urged customers to update to the newest release promptly to reduce the associated risks. SonicWall did not share details about the reported exploitation.

SonicWall credited Ryan Harris of The Electronic Office with finding and reporting the flaw. The U.S. Cybersecurity and Infrastructure Security Agency placed CVE-2026-19868 on its Known Exploited Vulnerabilities list, confirming in-the-wild exploitation. Federal civilian agencies must remediate by November 20, 2026, per CISA.

The advisory also addresses six additional vulnerabilities in SonicOS. Two management interface vulnerabilities scored 8.8 and let unauthenticated attackers perform unauthorized actions under certain conditions. Other patches fix pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that may result in denial of service, plus weak password hashing on virtual appliances.

The affected releases are SonicOS Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015. SonicWall delivered patches in 7.3.4-7013 and 8.2.3-8015 and said no workarounds are available. Administrators should apply the newest release without delay.

The advisory follows multiple attacks against SonicWall's SMA1000 secure remote access appliances. In October, researchers saw exploitation attempts against CVE-2026-102255, a max-severity flaw that could let unauthenticated attackers reach internal functions and take unauthorized actions. Before that, September attacks combined two SMA1000 zero-days for remote code execution, and July attacks used two other zero-days to install malware.