SonicWall Patches Exploited SonicOS CVE-2026-19868 VPN Flaw

SonicWall has patched a high-severity vulnerability in the SonicOS SSL VPN component, tracked as CVE-2026-19868, warning that the flaw may have been exploited in attacks. The issue allows an authenticated user with valid credentials for an alternate authentication method to bypass SAML authentication controls and multi-factor authentication (MFA). Disclosed in an advisory on 6 November, the flaw carries a CVSS score of 7.1. Devices are exposed only if SAML login is enabled. The US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog.

Key Facts

How Does the CVE-2026-19868 Vulnerability Function?

An authentication enforcement vulnerability in the SonicOS SSL VPN service allows users holding valid credentials for an alternate authentication method to bypass SAML authentication controls. When successfully exploited, attackers can circumvent SAML-enforced multi-factor authentication. According to SonicWall, an SSL VPN deployment is exposed to this security risk only if SAML-based login is enabled.

The flaw was reported by Ryan Harris of The Electronic Office and was published on 6 November alongside six other vulnerabilities. Two of those remaining flaws affect the SonicOS management interface with CVSS scores of 8.8, while others include three denial-of-service buffer overflows and a weak password hashing issue on virtual appliances.

Successful exploitation of CVE-2026-19868 allows a user to bypass SAML-enforced multi-factor authentication controls.

Has the SonicOS Vulnerability Been Exploited in Attacks?

SonicWall confirmed its product security team investigated a report indicating potential exploitation of CVE-2026-19868 in attacks. Following this disclosure, the US Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on 6 November, requiring US federal agencies to apply fixes by 20 November under Binding Operational Directive 26-04.

Neither SonicWall nor CISA has shared specific technical details regarding the suspected attacks. It remains unconfirmed whether threat actors exploited the flaw as a zero-day before a patch was available. SonicWall’s advisory did not mark any of the other six disclosed flaws as exploited.

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November.

What Should You Do?

• Upgrade affected Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or older to SonicOS version 7.3.4-7013.
• Upgrade affected Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or older to SonicOS version 8.2.3-8015.
• Note that there are no workarounds available for this issue, making official firmware updates necessary.
• Malaysian organisations observing anomalous SSL VPN activity or suspected security incidents can report the event to Cyber999 (MyCERT).

Common Questions

Are there any temporary workarounds for CVE-2026-19868?

SonicWall confirmed that there are no workarounds for this vulnerability. Affected organisations must upgrade their firewall firmware to SonicOS version 7.3.4-7013 or 8.2.3-8015 to mitigate the risk of authentication bypass.

Which specific firewall generations and versions are affected?

The flaw affects Gen7 TZ, NSa, NSsp, and NSv firewalls with SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa, and NSv firewalls with SonicOS 8.2.2-8015 or older, provided SAML-based login is enabled.

Were any of the other six disclosed flaws exploited?

SonicWall’s advisory did not mark any of the other six disclosed vulnerabilities as exploited. Those issues include management interface bugs, pre-authentication buffer overflows causing denial of service, and weak password hashing on virtual appliances.

Sources and Methodology

This dispatch is based entirely on reporting published by SecurityWeek in an article by Eduard Kovacs. It incorporates vulnerability data from SonicWall's advisory and catalog updates from CISA as cited in the source text. No additional vendor documentation or external sources were reviewed.