SonicWall has released security updates addressing seven vulnerabilities in its SonicOS firewalls, one of which is an SSL-VPN authentication bypass that has been exploited in real attacks. The flaw, tracked as CVE-2026-19868 and rated 7.1 on the CVSS scale, lets an attacker who already holds valid credentials for an alternate authentication method bypass SAML authentication controls. That can include SAML-enforced multi-factor authentication (MFA). Only SonicOS SSL-VPN services configured to use SAML are affected.

In a security advisory published on Friday, SonicWall said its PSIRT had investigated a report of potential exploitation and strongly urged customers to upgrade as soon as possible. Ryan Harris of The Electronic Office is credited with discovering and reporting the issue. SonicWall has not shared details about the reported attacks. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has nonetheless added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, and federal civilian agencies were ordered to secure affected systems by November 20, 2026.

Six Additional SonicOS Flaws Fixed

The same advisory addresses six other vulnerabilities in SonicOS:

  • Two management interface flaws rated 8.8 in severity, which allow unauthenticated attackers to perform unauthorized operations under specific conditions.
  • Pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions.
  • A weak password hashing issue affecting virtual appliances.

The affected builds are SonicOS Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier. Fixes are included in versions 7.3.4-7013 and 8.2.3-8015. SonicWall states that no workarounds are available, so patching is the only mitigation.

A Pattern of Targeted Activity

The warning follows a run of attacks against SonicWall’s SMA1000 secure remote access appliances. Researchers detected exploitation attempts in October against CVE-2026-102255, a maximum-severity flaw allowing unauthenticated access to internal functionality. Earlier campaigns in September chained two SMA1000 zero-days to achieve remote code execution, and attacks in July exploited two other zero-days to deploy malware. Security teams running SonicWall VPN and firewall infrastructure should treat remote access gateways as a priority for patching and for reviewing authentication logs for signs of bypass.