SonicWall fixes SSL-VPN MFA bypass flaw exploited in attacks | Межа

The vulnerability can let attackers with valid credentials for an alternate authentication method bypass SAML controls, including SAML-enforced MFA.

SonicWall has released updates for seven vulnerabilities in its SonicOS firewalls, including CVE-2026-19868, an authentication bypass flaw in SSL-VPN services configured to use SAML. The vulnerability has a CVSS score of 7.1.

This is reported by BleepingComputer .

SonicWall said in a security advisory that it investigated a report of possible exploitation and urged customers to install the latest updates. Ryan Harris of The Electronic Office discovered and reported the flaw. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added it to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild. CISA directed federal civilian executive branch agencies to secure affected systems by November 20, 2026.

SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks, – SonicWall

SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks,

The six other flaws include two management interface vulnerabilities rated 8.8 that can allow unauthenticated attackers to perform unauthorized operations under specific conditions. Other issues include pre-authentication buffer overflows in SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password-hashing flaw affecting virtual appliances.

The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. SonicWall fixed them in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.

The warning follows attacks targeting SonicWall SMA1000 secure remote access appliances. In October, researchers detected attempts to exploit CVE-2026-102255, a maximum-severity flaw that could let unauthenticated attackers access internal functionality and perform unauthorized operations. Those attempts followed September attacks that chained two SMA1000 zero-days to achieve remote code execution, and July attacks that used two other zero-days to deploy malware on vulnerable appliances.