SonicWall patches critical SSL-VPN authentication bypass flaw in SonicOS

SonicWall has rolled out security updates to address seven vulnerabilities within its SonicOS firewalls. Among them is a high-risk SSL-VPN authentication bypass flaw that has already been targeted in active cyberattacks in the wild.

• Tracked as CVE-2026-19868, the vulnerability carries a CVSS severity score of 7.1.
• It specifically affects SonicOS SSL-VPN services configured to use SAML authentication controls.
• Cybersecurity authorities have confirmed active exploitation and urged immediate patching.

Details of the Authentication Bypass

The vulnerability allows attackers who possess valid credentials for an alternate authentication method to bypass SAML authentication mechanisms. This potentially enables threat actors to circumvent SAML-enforced multi-factor authentication (MFA) protections.

The issue impacts SonicOS Gen7 versions 7.3.3-7015 and earlier, alongside Gen8 versions 8.2.2-8015 and earlier. SonicWall has patched the flaws in versions 7.3.4-7013 and 8.2.3-8015, confirming that no workarounds are currently available.

Additional Fixes in the SonicOS Advisory

Along with the SSL-VPN flaw discovered by Ryan Harris of The Electronic Office, the security advisory addresses six other vulnerabilities. Two of these are management interface flaws rated 8.8 in severity, which could permit unauthenticated attackers to execute unauthorized actions under specific conditions.

Other fixed issues include pre-authentication buffer overflows in SSL-VPN and TACACS+ services leading to potential denial-of-service conditions, as well as a weak password hashing bug impacting virtual appliances.

CISA Action and Industry Impact

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has formally added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. Federal agencies were directed to secure affected systems to mitigate ongoing risks.

This advisory follows a series of recent security challenges and attacks targeting SonicWall infrastructure appliances. System administrators are strongly advised to upgrade their firewalls to the latest firmware versions immediately.