SonicWall has issued urgent security warnings and released software updates to fix seven security vulnerabilities affecting SonicOS firewalls, including a critical vulnerability that allows authentication bypass in SSL-VPN services, which has been confirmed to be exploited in actual targeted attacks.
Vulnerability Details and Impact on VPN Systems
The vulnerability in question carries the tracking identifier CVE-2026-19868 and has a severity score of 7.1 on the CVSS scale. The vulnerability directly affects SonicOS SSL-VPN services configured exclusively to use SAML authentication. This vulnerability allows attackers with valid credentials for an alternative authentication method to bypass SAML authentication controls, including bypassing the two-factor or multi-factor authentication (MFA) enforced via the protocol.
Ryan Harris of The Electronic Office discovered and reported this vulnerability, while the Cybersecurity and Infrastructure Security Agency (CISA) promptly added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, issuing a binding directive for federal agencies to secure affected systems by November 20, 2026.
Additional Flaws and Remediation Updates
The security updates were not limited to the authentication bypass vulnerability; the company also addressed six other vulnerabilities in the SonicOS system. This list included two management interface vulnerabilities rated at 8.8 severity, which allow unauthenticated attackers to execute unauthorized operations under specific conditions. The patches also included pre-authentication buffer overflow vulnerabilities in the SSL-VPN and TACACS+ services that could lead to denial-of-service conditions, as well as a weak password hashing vulnerability affecting virtual appliances.
What Changes Practically for Users?
- Affected Scope: Gen7 SonicOS versions up to 7.3.3-7015, and Gen8 versions up to 8.2.2-8015 are affected.
- Available Solution: The company has released definitive fixes in versions 7.3.4-7013 and 8.2.3-8015, confirming that no temporary workarounds are available except for immediate updating.
- Practical Implications: IT administrators and system managers are urged to apply the security patches immediately due to evidence of active exploitation in current cyberattacks against the company's products.