If your remote access runs through a SonicWall firewall with SAML single sign-on, your MFA may not be protecting you until you patch. SonicWall has fixed an SSL-VPN flaw that attackers are already exploiting, and the vendor says there are no workarounds. The only mitigation is a firmware upgrade, so this belongs at the top of this week’s change calendar.

What happened

According to BleepingComputer, SonicWall released updates for seven SonicOS vulnerabilities. The most urgent is CVE-2026-19868, an SSL-VPN authentication bypass with a CVSS score of 7.1. An attacker holding valid credentials for an alternate authentication method can get around SAML controls, potentially including MFA enforced through SAML. It only affects SSL-VPN services configured for SAML authentication.

SonicWall’s advisory says its PSIRT investigated a report of potential exploitation and urges customers to upgrade quickly. The company has not shared details of the attack. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild, and set a November 20, 2026 deadline for federal civilian agencies. The researcher Ryan Harris of The Electronic Office reported the bug.

The same advisory covers six other issues. Two management interface flaws rated 8.8 let unauthenticated attackers perform unauthorized operations under specific conditions. Pre-authentication buffer overflows in SSL-VPN and TACACS+ can cause denial of service, and virtual appliances have a weak password hashing problem. Gen7 versions up to 7.3.3-7015 and Gen8 versions up to 8.2.2-8015 are affected. Fixes ship in 7.3.4-7013 and 8.2.3-8015.

Why it matters

A 7.1 score understates the practical risk. The attacker needs valid credentials for some other login method, but that is a low bar when stolen or reused credentials are common. The likely effect is that SAML-enforced MFA, the control many organisations treat as the safety net for VPN access, stops being one for affected configurations.

The pattern also matters. BleepingComputer notes this follows repeated attacks on SonicWall’s separate SMA1000 remote access appliances: zero-days exploited in July, a chained pair in September and a maximum-severity bug targeted in October. Those are a different product line from SonicOS firewalls. Even so, this suggests internet-facing remote access gear from this vendor is under steady attacker attention, and buyers should price that into their risk models.

Edge devices that handle authentication are attractive because one bypass gives a foothold inside the network. Related reading on our site shows the same theme: the *sshole bug also turned a login control into a hole.

What it means for you

  • Find your exposure. Check whether any SonicOS Gen7 or Gen8 firewall runs SSL-VPN with SAML. Compare firmware against 7.3.4-7013 and 8.2.3-8015.
  • Patch first, then review. With no workaround, schedule the upgrade now rather than at the next maintenance window. Treat the November 20 CISA date as a sensible benchmark even if you are not a federal agency.
  • Hunt for past abuse. Review VPN logs for logins where the authentication method differs from what the user normally uses, or where SAML and MFA events do not line up. Exploitation details are not public, so broad review is safer than waiting for indicators.
  • Limit the credential bar. Retire or disable alternate authentication methods you do not need, and rotate credentials for accounts with VPN access if you see anomalies.
  • Ask your vendor. Ask SonicWall or your reseller how fast fixes arrive, how exploitation is disclosed and how to restrict management interfaces. Include the answers in renewal talks.

Also close the management interface exposure. Two of the other fixed flaws score 8.8, so make sure admin access is not reachable from the internet.

What to watch

  • Whether SonicWall or researchers publish details of the observed attacks, which would help with detection.
  • Whether the 8.8-rated management flaws or the SSL-VPN overflows also join CISA’s exploited list.
  • Further activity against SMA1000 appliances after the October attempts.
  • Whether the November 20 federal deadline is followed by new guidance. Our cybersecurity page tracks updates.

Sources