SonicWall has issued fixes for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw that has been actively exploited in the wild.
The SSL-VPN vulnerability, tracked as CVE-2026-19868, carries a CVSS score of 7.1, and could allow attackers to bypass SAML authentication and its multi-factor authentication (MFA) checks. An SSL VPN is exposed only if SAML-based login is enabled.
“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls," the SonicWall advisory reads.
"Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).”
Notably, SonicWall warned that the vulnerability has been spotted in the wild and has investigated a report "indicating potential exploitation”. It didn't give any further information about which organizations might have been hit and what may have happened as a result.
The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, with CISA confirming that it's been exploited in the wild. Agencies are directed to address the flaw by November 20.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the agency warned.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
SonicWall patches six more flaws
The advisory also covers six further vulnerabilities in SonicOS. CVE-2026-107155, with a CVSS score of 8.8, is a permissive cross-domain policy vulnerability in the SonicOS management interface.
In certain circumstances, SonicWall said this could enable a remote unauthenticated attacker to perform unauthorized operations.
CVE-2026-107154, with a CVSS score of 8.8, is a session validation vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Other vulnerabilities highlighted in the advisory include:
- CVE-2026-82308: A pre-authentication heap-based buffer overflow vulnerability that could enable a remote unauthenticated attacker to cause an application-level denial of service (CVSS score of 7.5)
- CVE-2026-77708: A pre-authentication stack-based buffer overflow vulnerability in the SonicOS TACACS+ authentication client (CVSS score of 5.9)
- CVE-2026-77709: A pre-authentication heap-based buffer overflow vulnerability in the SonicOS TACACS+ authentication client (CVSS score of 5.9)
- CVE-2026-19703: A weak password hashing vulnerability identified on SonicOS virtual appliances (CVSS score of 5.2)
The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier, along with Gen8 versions 8.2.2-8015 and earlier.
SonicWall said it has fixed the issues in versions 7.3.4-7013 and 8.2.3-8015, and that no workarounds are available. Organizations are advised to update as quickly as possible.