SonicWall fixes exploited firewall bug allowing attackers to skirt VPN authentication checks

SonicWall has issued security updates to resolve seven vulnerabilities across its SonicOS firewalls, including an actively targeted authentication bypass flaw. Tracked as CVE-2026-19868 with a CVSS severity score of 7.1, the bug enables attackers holding valid credentials for an alternate login method to get past SAML authentication controls, potentially bypassing SAML-enforced multi-factor authentication. Ryan Harris of The Electronic Office discovered and reported the issue. [1][2]

The vulnerability strictly affects SonicOS SSL-VPN services configured to rely on SAML authentication. Impacted deployments include SonicOS Gen7 releases 7.3.3-7015 and earlier alongside Gen8 versions 8.2.2-8015 and earlier. SonicWall released fixes in versions 7.3.4-7013 and 8.2.3-8015, noting that no workarounds exist. The broader advisory also remediates two 8.8-severity management interface flaws, pre-authentication buffer overflows in SSL-VPN and TACACS+ services, and a weak password hashing bug in virtual appliances. [2]

SonicWall stated that it investigated a report indicating potential exploitation in an attack and advised immediate upgrades. The U.S. Cybersecurity and Infrastructure Security Agency subsequently confirmed in-the-wild exploitation by placing CVE-2026-19868 onto its Known Exploited Vulnerabilities catalog. CISA has mandated that federal civilian agencies patch affected devices by November 20, 2026. [2]