SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks

SonicWall has released security updates to fix seven vulnerabilities in its SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.

The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA).

The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication.

In a security advisory published on November 7, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates.

SonicWall stated, “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” The vulnerability was discovered and reported by Ryan Harris of The Electronic Office.

While SonicWall has not shared details about the reported exploitation, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, confirming that the flaw has been exploited in the wild.

CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.

The advisory also fixes six additional vulnerabilities in SonicOS, including two management interface flaws rated 8.8 severity that allow unauthenticated attackers to perform unauthorized operations under specific conditions.

The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password hashing vulnerability affecting virtual appliances.

The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.

This warning follows a series of attacks targeting SonicWall’s SMA1000 secure remote access appliances.

Source: BleepingComputer