SonicWall has announced the release of urgent security updates to address a severe security vulnerability in the SonicOS operating system, which directly affects its VPN network components. This vulnerability, tracked as CVE-2026-19868, allows attackers who possess credentials for alternative authentication methods to bypass SAML authentication controls, including bypassing enforced multi-factor authentication (MFA).
What does this mean for users?
The severity of this vulnerability lies in the fact that it significantly weakens remote access security. If a user has enabled SAML-based login, an attacker possessing valid credentials for another method can access the system without having to pass SAML or multi-factor authentication checks. The vulnerability has been classified as high-severity with a score of 7.1 on the CVSS scale.
Required actions
SonicWall confirmed that its Product Security Incident Response Team has investigated reports indicating potential exploitation of this vulnerability in actual attacks. Consequently, the US Cybersecurity and Infrastructure Security Agency (CISA) added the vulnerability to its Known Exploited Vulnerabilities (KEV) catalog, obligating federal agencies to remediate the flaw by November 20.
Affected devices include:
- Gen7 devices (TZ, NSa, NSsp, NSv) running SonicOS version 7.3.3-7015 or earlier.
- Gen8 devices (TZ, NSa, NSv) running SonicOS version 8.2.2-8015 or earlier.
System administrators must immediately upgrade to versions 7.3.4-7013 or 8.2.3-8015, as there are no workarounds to mitigate the risks other than software updates.
Additional vulnerabilities
In addition to this vulnerability, the security bulletin included six other vulnerabilities, including two in the SonicOS management interface with a severity score of 8.8, which allow attackers to execute unauthorized actions without logging in under certain circumstances, as well as other vulnerabilities related to buffer overflows in the SSL VPN service and the TACACS+ authentication client, which could lead to denial-of-service (DoS) attacks.