SonicWall Fixes SSL-VPN MFA Bypass Flaw

SonicWall has released security updates to fix a critical vulnerability in its SonicOS firewalls that allows attackers to bypass multi-factor authentication (MFA).

The flaw, identified as CVE-2026-19868, has a CVSS severity score of 7.1. It specifically targets SonicOS SSL-VPN services using SAML authentication. An attacker with valid credentials for an alternative authentication method can exploit the flaw to circumvent SAML-enforced MFA. Ryan Harris of The Electronic Office discovered the vulnerability.

CISA Directs Federal Agencies to Patch

The CISA Known Exploited Vulnerabilities (KEV) catalogue has added the flaw following evidence of active exploitation. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has ordered federal civilian executive branch agencies to secure all affected systems by 20 November 2026.

Additional Security Fixes

The security updates also address six other vulnerabilities in SonicOS. These include two flaws in the management interface rated at 8.8 severity, which could allow unauthenticated attackers to perform unauthorised operations under certain conditions. Other fixes address pre-authentication buffer overflows in the SSL-VPN and TACACS+ services, alongside a weak password hashing vulnerability in virtual appliances.

The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. SonicWall has released versions 7.3.4-7013 and 8.2.3-8015 to resolve these issues. The company stated that no workarounds are available to mitigate the MFA bypass flaw.

This disclosure follows a series of recent attacks targeting SonicWall’s SMA1000 secure remote access appliances, which included the exploitation of multiple zero-day vulnerabilities earlier this year.