Skip to content
SonicWall Patches High-Severity VPN Flaw Exploited in Attacks

SonicWall Patches High-Severity VPN Flaw Exploited in Attacks

First seen 7 Nov 2026, 11:16 UTC • •
API

Article Content

Browse articles
ThreatCluster AI
ThreatCluster •November 7, 2026 at 12:22 UTC
  • •CVE-2026-19868 allows bypassing SAML authentication in SonicWall SSL VPNs.
  • •The vulnerability has a CVSS score of 7.1 and may have been exploited in attacks.
  • •CISA added the flaw to its KEV catalog, requiring federal agencies to act by November 20.

SonicWall has patched a high-severity vulnerability in SonicOS, tracked as CVE-2026-19868, that allows attackers with valid credentials for alternative authentication methods to bypass SAML authentication controls, including multi-factor authentication (MFA). The flaw, which has a CVSS score of 7.1, affects SSL VPN services configured for SAML authentication and may have been exploited in the wild. SonicWall's advisory, published on November 6, 2026, urged customers to upgrade to the latest versions of SonicOS to mitigate risks. CISA added this vulnerability to its Known Exploited Vulnerabilities (KEV) catalog on the same day, mandating federal agencies to secure affected systems by November 20, 2026. The vulnerability impacts Gen7 and Gen8 SonicWall firewalls running specific older versions of SonicOS. SonicWall's advisory also mentions six additional vulnerabilities, two of which are rated even higher at 8.8, affecting the management interface.

Start a free Starter trial for enhanced analysis

Ask AI about this cluster

Updated 3h ago How this analysis works

Timeline

2026-11-06
CVE-2026-19868 published
SonicWall disclosed a vulnerability allowing bypass of SAML authentication in SSL VPN services.
Securityweek
2026-11-06
CVE added to CISA KEV catalog
CISA confirmed the vulnerability's exploitation in the wild and added it to its KEV catalog.
Bleepingcomputer
2026-11-07
SonicWall issues security advisory
SonicWall urged customers to upgrade to the latest SonicOS versions to mitigate risks from the vulnerability.
Securityaffairs.Co

More articles in this cluster (6)

Following this threat?

Track Sonicwall and CVE-2026-102255 in your own feed — you're alerted when they show up in new reporting, leak sites or exploitation.

Free account · no card needed

Extracted Entities (11)

1 / 4

Common questions

Which SonicWall versions are affected?
Affected versions include Gen7 SonicOS 7.3.3-7015 and earlier, and Gen8 SonicOS 8.2.2-8015 and earlier.
What should I do if I use SonicWall products?
Upgrade to SonicOS versions 7.3.4-7013 or 8.2.3-8015 immediately to mitigate risks.
Is there evidence of active exploitation?
Yes, CISA confirmed that the vulnerability has been exploited in the wild.