SonicWall has released security updates for SonicOS firewalls after a vulnerability in SSL-VPN authentication was reported as exploited in an attack. The flaw affects only SonicOS SSL-VPN services set up to use SAML authentication, and SonicWall says customers should install the latest updates.
CVE-2026-19868 and SAML authentication
The issue is tracked as CVE-2026-19868. It lets an attacker who already has valid credentials for an alternate authentication method bypass SAML authentication controls, which can include SAML-enforced multi-factor authentication. The flaw has a CVSS severity score of 7.1.
SonicWall said in a security advisory published Friday that its PSIRT investigated a report indicating possible exploitation. The company said customers should upgrade to the latest release as soon as possible to reduce the risk tied to the flaw. Ryan Harris of The Electronic Office discovered and reported the vulnerability.
CISA adds the flaw to its exploit list
SonicWall has not shared details about the reported exploitation. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, which confirms that the flaw has been exploited in the wild. CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.
Other SonicOS issues fixed
The advisory also addresses six more vulnerabilities in SonicOS. Two of them are management interface flaws rated 8.8 that can let unauthenticated attackers perform unauthorized operations under specific conditions. The remaining issues include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could lead to denial-of-service conditions, along with a weak password hashing issue affecting virtual appliances.
The bugs affect SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. SonicWall says the fixes are in versions 7.3.4-7013 and 8.2.3-8015, and it says no workarounds are available.
Pattern of attacks on SonicWall appliances
The warning follows a series of attacks aimed at SonicWall’s SMA1000 secure remote access appliances. In October, security researchers detected exploitation attempts against CVE-2026-102255, a maximum-severity flaw that could let unauthenticated attackers reach internal functionality and carry out unauthorized operations. Those attempts came after September attacks that chained two SMA1000 zero-days to achieve remote code execution, and after July attacks that used two other zero-days to deploy malware on vulnerable appliances.
Licensed under CC BY-ND 4.0 International