615/69 Friday, November 9, 2026
SonicWall has released security updates to address CVE-2026-19868, a High-severity vulnerability with a CVSS score of 7.1 affecting the SSL VPN service in SonicOS. The flaw could allow an attacker who already possesses valid credentials for an alternative authentication method to bypass SAML authentication and potentially bypass Multi-Factor Authentication (MFA) enforced through SAML. The vulnerability affects SSL VPN environments where SAML authentication is enabled. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) Catalog on November 6, 2026, after confirming evidence of active exploitation.
The vulnerability is caused by improper enforcement of the authentication process, allowing an attacker to use valid credentials from another supported login method to access the SSL VPN without completing the SAML and MFA checks required by the organization. However, the flaw cannot be exploited without valid credentials. Affected products include SonicOS Gen 7 version 7.3.3-7015 and earlier, as well as SonicOS Gen 8 version 8.2.2-8015 and earlier.
Administrators should update SonicOS Gen 7 to version 7.3.4-7013 or later and SonicOS Gen 8 to version 8.2.3-8015 or later. SonicWall stated that no workaround is available for the vulnerability. Organizations should also review SSL VPN connection logs and investigate unusual authentication activity, particularly involving accounts that normally use SAML and MFA. If suspicious activity is identified, administrators should assess access to internal systems and rotate relevant credentials. CISA requires U.S. Federal Civilian Executive Branch agencies to remediate the vulnerability by November 20, 2026.
Source: https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/