SonicWall fixes exploited firewall VPN flaw that can bypass multi-factor authentication

What happened

SonicWall published a security advisory on November 6, 2026, that fixes seven vulnerabilities in SonicOS, the operating system that runs on its firewalls, BleepingComputer and SecurityWeek reported. One of them, CVE-2026-19868, is in the firewalls' SSL-VPN service. A virtual private network (VPN) extends a private network, such as a company network, across a public network such as the internet.

SonicWall describes CVE-2026-19868 as an authentication enforcement vulnerability that "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls," according to the flaw's CVE record. SAML (Security Assertion Markup Language) is an open standard for exchanging login data between an identity provider and a service. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA), which requires two or more proofs of identity before granting access, SonicWall said.

The flaw has a severity score of 7.1 out of 10, rated high, according to BleepingComputer and SecurityWeek. Ryan Harris of The Electronic Office discovered and reported it, both outlets reported.

Exploitation

SonicWall said its product security team "has investigated a report indicating potential exploitation of this vulnerability," BleepingComputer and SecurityWeek reported. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog on November 6, 2026, which BleepingComputer said confirms that the flaw has been exploited in the wild.

Neither SonicWall nor CISA has shared details about the suspected attacks, according to SecurityWeek, which said it is also unclear whether the flaw was exploited as a zero-day, before a patch became available. CISA's catalog entry lists whether the flaw has been used in ransomware campaigns as unknown.

Who is affected

The flaw affects Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or older, SecurityWeek reported. SonicWall said an SSL-VPN is exposed only when SAML-based login is enabled, according to SecurityWeek. BleepingComputer said the flaw only affects SSL-VPN services configured to use SAML authentication.

SonicWall's advisory does not mark the other six flaws as exploited, according to SecurityWeek. Two of them, each rated 8.8 out of 10, are in the SonicOS management interface and could let a remote attacker take unauthorized actions without logging in under certain circumstances. Three others could let attackers who have not logged in cause a denial of service in the SSL-VPN service or the TACACS+ authentication client. The last is a weak password hashing issue in virtual appliances.

What organizations should do

SonicWall fixed the flaws in SonicOS 7.3.4-7013 and 8.2.3-8015 and said no workarounds are available, according to BleepingComputer and SecurityWeek. "Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks," SonicWall said in its advisory, as quoted by both outlets.

Under Binding Operational Directive (BOD) 26-04, U.S. federal civilian agencies must address the flaw by November 20, 2026. CISA's catalog entry tells agencies to apply mitigations according to the vendor's instructions or to stop using the product if mitigations are unavailable.

Background

CISA's KEV catalog includes 20 SonicWall vulnerabilities, SecurityWeek reported. In October 2026, researchers detected exploitation attempts against CVE-2026-102255, a maximum-severity flaw in SonicWall's SMA1000 secure remote access appliances, according to BleepingComputer. Those attempts followed attacks in September that combined two SMA1000 zero-days to run code remotely, and attacks in July that used two other zero-days to install malware, BleepingComputer reported. As of November 7, CISA had not added CVE-2026-102255 to its catalog, according to SecurityWeek.