SonicWall Patches Active MFA Bypass Flaw in SSL-VPN

SonicWall released patches for seven SonicOS firewall vulnerabilities, led by CVE-2026-19868, an actively exploited SSL-VPN authentication bypass. The flaw allows attackers with valid alternate credentials to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication, and carries a CVSS score of 7.1. CISA confirmed active exploitation and mandated federal agencies secure affected systems by November 20, 2026.

The update addresses six additional flaws, including two management interface vulnerabilities rated 8.8 severity enabling unauthenticated unauthorized operations, pre-authentication buffer overflows in SSL-VPN and TACACS+ services causing denial-of-service, and weak password hashing affecting virtual appliances. Vulnerable versions span SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier; fixes appear in 7.3.4-7013 and 8.2.3-8015 with no available workarounds. This patch follows escalating SonicWall exploitation: October saw exploitation attempts against a maximum-severity flaw, September attacks chained two zero-days enabling remote code execution, and July attacks deployed malware via zero-days.