SonicWall has issued an urgent security advisory regarding a critical vulnerability in its SonicOS firewalls that allows attackers to bypass multi-factor authentication (MFA). The flaw, tracked as CVE-2026-19868, carries a CVSS severity score of 7.1 and specifically impacts SSL-VPN services configured to utilize SAML authentication. By leveraging valid credentials for an alternative authentication method, an attacker can circumvent SAML-enforced security controls.
The company confirmed that it has investigated reports indicating the vulnerability has been exploited in the wild. While SonicWall has not provided specific details regarding the nature of these attacks, the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has officially added the flaw to its Known Exploited Vulnerabilities catalog. As a result, federal civilian executive branch agencies are under a mandate to secure their affected systems by November 20, 2026.
The vulnerability was identified and reported by Ryan Harris of The Electronic Office. SonicWall has stated that there are no available workarounds for the issue, and the only effective mitigation is to apply the provided security updates immediately. The flaw affects SonicOS Gen7 versions 7.3.3-7015 and earlier, as well as Gen8 versions 8.2.2-8015 and earlier. Patches have been released in versions 7.3.4-7013 and 8.2.3-8015.
In addition to the MFA bypass, the security update addresses six other vulnerabilities within the SonicOS ecosystem. Among these are two management interface flaws, both rated with a high severity score of 8.8. These specific vulnerabilities could allow an unauthenticated attacker to perform unauthorized operations under certain conditions.
The remaining vulnerabilities addressed in the latest update include pre-authentication buffer overflows affecting both the SSL-VPN and TACACS+ services. These flaws pose a risk of denial-of-service conditions, potentially disrupting network operations. Furthermore, the update resolves a weak password hashing vulnerability that specifically impacts virtual appliances.
This latest security alert follows a period of heightened activity targeting SonicWall infrastructure. In October, researchers observed exploitation attempts against CVE-2026-102255, a maximum-severity flaw in SMA1000 secure remote access appliances that allowed unauthenticated attackers to access internal functionality.
The recent string of incidents involving SonicWall products includes a series of attacks throughout the latter half of 2026. In September, attackers successfully chained two zero-day vulnerabilities in SMA1000 appliances to achieve remote code execution. Additionally, in July, two separate zero-day flaws were exploited in the wild to deploy malicious software onto vulnerable appliances.
Administrators are strongly advised to audit their environments for these specific versions and apply the necessary patches as a priority. Given the confirmation of active exploitation by both the vendor and federal authorities, the risk to unpatched systems remains significant.
