SonicWall has issued emergency patches for its SonicOS operating system to address a high-severity authentication vulnerability currently being exploited in the wild. The flaw, tracked as CVE-2026-19868, resides within the SSL VPN component of the company’s firewall appliances. According to the vendor, the vulnerability allows an attacker who possesses valid credentials for an alternative authentication method to bypass SAML-based login requirements. This bypass effectively allows unauthorized parties to circumvent SAML-enforced multi-factor authentication, granting them access to the VPN.
The vulnerability carries a CVSS score of 7.1 and was identified and reported to the vendor by Ryan Harris of The Electronic Office. SonicWall confirmed that its internal security team has investigated reports indicating that the flaw has been subject to active exploitation. While the company acknowledged these reports, it has not provided specific details regarding the nature or scope of the observed attacks, nor has it confirmed whether the vulnerability was utilized as a zero-day prior to the release of the patches.
The Cybersecurity and Infrastructure Security Agency (CISA) has officially added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. Under the requirements of Binding Operational Directive 26-04, federal agencies are mandated to apply the necessary patches by November 20, 2026. SonicWall has emphasized that there are no available workarounds for this issue and has urged all customers to update their systems immediately.
The impacted hardware includes Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS version 7.3.3-7015 or older, as well as Gen8 TZ, NSa, and NSv models running SonicOS version 8.2.2-8015 or older. Users are advised to upgrade to SonicOS versions 7.3.4-7013 or 8.2.3-8015 to remediate the risk. The vendor noted that the vulnerability is only a concern for devices where SAML-based login is explicitly enabled.
In addition to the VPN flaw, SonicWall’s November 6 advisory detailed six other vulnerabilities within SonicOS. Among these are two high-severity issues affecting the management interface, both carrying a CVSS score of 8.8. One is a session validation bug, and the other is a permissive cross-domain policy issue. Both could potentially allow a remote, unauthenticated attacker to perform unauthorized actions under specific conditions.
The remaining four vulnerabilities addressed in the update include three pre-authentication buffer overflows affecting the SSL VPN service and the TACACS+ authentication client, which could be leveraged to trigger application-level denial-of-service conditions. The final vulnerability involves a weak password hashing implementation in virtual appliances. This specific issue could be exploited by an attacker who has already obtained high-privileged local access to retrieve platform credentials, potentially exposing sensitive system settings.
SonicWall has not indicated that any of these additional six vulnerabilities have been exploited in the wild. The company continues to face frequent scrutiny regarding the security of its products, with the current incident marking another addition to a long list of vulnerabilities tracked by federal authorities. Organizations utilizing SonicWall infrastructure are encouraged to review the full advisory to ensure all identified security gaps are closed through the provided software updates.
