SonicWall Patches SonicOS Authentication Bypass Flaw CVE-2026-19868, Warns of Potential Exploitation
Cybersecurity and privacy
SonicWall disclosed seven flaws in SonicOS, led by CVE-2026-19868, which lets attackers with valid secondary credentials bypass SAML authentication and MFA on SSL-VPNs. SonicWall noted potential exploitation reports, CISA added it to KEV, and patches for Gen7 and Gen8 devices have been released.
SonicWall published a security advisory on November 6 disclosing seven vulnerabilities in its SonicOS firewall operating system. Among them, authentication bypass flaw CVE-2026-19868 has drawn significant scrutiny as the vendor stated it has investigated reports of potential exploitation and urged prompt updates; the U.S. CISA also added it to its Known Exploited Vulnerabilities (KEV) catalog on the same day. According to SonicWall, the flaw affects systems utilizing SAML for SSL-VPN logins, allowing attackers holding valid credentials for alternate methods to bypass SAML controls and enforced MFA. SonicWall released patches 7.3.4-7013 and 7.3.4-7015 for Gen7 devices, along with 8.2.3-8015 for Gen8 firewalls. As the exact timing of exploitation remains undisclosed, it is not yet confirmed whether attacks occurred prior to patches.
Key takeaways
- CVE-2026-19868 allows attackers with valid credentials from other methods to bypass SAML login controls and enforced MFA.
- The vulnerability only impacts firewall systems configured to use SAML for SSL-VPN authentication; SonicWall is investigating exploitation reports.
- The U.S. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog on the same day.
- SonicWall has rolled out patches for Gen7 (7.3.4-7013, 7.3.4-7015) and Gen8 (8.2.3-8015) firewall versions.
Source：iThome Read the original ↗
Prepared, checked and automatically published by AI; not individually reviewed by a human. Translation checked by AI.