SonicWall Warns of Exploited SSL-VPN Authentication Bypass in SonicOS

SonicWall has warned that a newly patched flaw in the SSL-VPN service of its SonicOS firewall operating system is being exploited in attacks. The advisory, SNWLID-2026-0014, covers fixes for seven vulnerabilities in total.

The exploited bug, CVE-2026-19868, carries a CVSS score of 7.1. On SSL-VPN services configured for SAML authentication, an attacker holding valid credentials for another authentication method can get around SAML controls, including multi-factor authentication enforced through SAML. SonicWall's PSIRT is investigating a report of exploitation but has not shared details.

CISA has added the flaw to its Known Exploited Vulnerabilities catalog, giving federal civilian agencies until November 20, 2026 to secure affected systems. The issue was reported by Ryan Harris of The Electronic Office.

The six other fixes include two management-interface flaws rated CVSS 8.8 that let unauthenticated attackers perform unauthorized operations under certain conditions. SonicWall also patched pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial of service, plus a weak password hashing problem on virtual appliances.

Gen7 firmware 7.3.3-7015 and earlier and Gen8 firmware 8.2.2-8015 and earlier are affected. The fixes are in 7.3.4-7013 and 8.2.3-8015, and SonicWall says no workarounds exist.

The disclosure follows a string of attacks on SonicWall products this year, including zero-day exploitation of SMA1000 appliances in July and September and attempts against a maximum-severity SMA1000 flaw in October. Administrators using SAML on SSL-VPN should patch promptly and review login logs for unexpected sessions.

Source: BleepingComputer

Raon Community wrote this article from the facts reported in the original. The original belongs to its author; see the source for full details.