SonicWall patches VPN flaw that is being exploited
SonicWall has fixed seven SonicOS firewall flaws, including an SSL-VPN login bypass that attackers are already exploiting, according to BleepingComputer.
The facts
- According to BleepingComputer, SonicWall fixed seven SonicOS vulnerabilities, including CVE-2026-19868, an SSL-VPN authentication bypass with a CVSS score of 7.1.
- The flaw only affects SSL-VPN services set up to use SAML authentication, and it could let attackers with valid credentials for another login method get around SAML controls, possibly including MFA.
- CISA added the flaw to its Known Exploited Vulnerabilities catalogue and told US federal civilian agencies to secure affected systems by November 20, 2026. SonicWall has not shared details of the attack.
- Affected versions are Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. Fixes are in 7.3.4-7013 and 8.2.3-8015, and SonicWall says there are no workarounds.
Case notes · Danny's take
Why it matters
MFA is the lock people trust most. When a bug lets attackers walk around it, the lock stops mattering. This is also not SonicWall's first problem this year: the source lists repeated attacks on its SMA1000 appliances in July, September and October. A VPN sits at the front door of a company network, so a flaw here is a flaw in everything behind it.
For builders
If you run SonicOS with SAML-based SSL-VPN, patching is the only fix, because SonicWall says there are no workarounds. Check your firmware version today and review VPN login logs for odd sign-ins. Do not assume MFA alone covers you.
Not financial advice. Do your own investigation.
This story was summarised with AI from BleepingComputer's reporting and checked against our editorial policy. Danny's take reflects his views. Disclaimer.
Danny Walter
Founder of Moon Republic, Volt Terminal and Moon Republic Academy. Author of The Market Is a Crime Scene and After the Applause.