SonicWall patches actively exploited SSL-VPN MFA bypass flaw

By Amara Osei

SonicWall patched seven SonicOS vulnerabilities after attackers exploited a CVSS 7.1 SSL-VPN flaw that can bypass SAML-enforced multi-factor authentication.

What changed in Friday’s advisory?

SonicWall fixed the flaws in SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. The vulnerable releases include Gen7 7.3.3-7015 and earlier, plus Gen8 8.2.2-8015 and earlier. The company says no workarounds are available.

In its Friday advisory, the company warned: “SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.”

SonicWall has not disclosed details of the reported attack. The U.S. Cybersecurity and Infrastructure Security Agency (CISA), however, added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, confirming that the flaw has been exploited in the wild.

Takeaway: Organizations running affected SonicOS releases need to install the fixed version rather than rely on a temporary mitigation.

How does the MFA bypass work?

Attackers need valid credentials for an alternate authentication method. From that starting point, they can bypass SAML authentication controls, potentially including MFA that an organization enforces through SAML.

The flaw carries a CVSS severity score of 7.1. It affects only SonicOS SSL-VPN services configured to use SAML authentication, so exposure depends on both the vulnerable SonicOS release and that specific configuration.

Ryan Harris of The Electronic Office discovered and reported the vulnerability.

Takeaway: Valid alternate credentials do not preserve SAML’s MFA safeguard on affected SSL-VPN services.

What do the other six flaws allow?

The same advisory addresses six more issues across SonicOS. Their disclosed impact spans unauthorized operations, service disruption and weak credential protection:

• Two management interface flaws carry a severity rating of 8.8. Under specific conditions, unauthenticated attackers can perform unauthorized operations.
• Pre-authentication buffer overflows in the SSL-VPN and TACACS+ services can cause denial-of-service conditions.
• A weak password hashing vulnerability affects virtual appliances.

The disclosed summary does not assign identifiers to those six issues, so the 8.8 rating applies specifically to the two management interface flaws rather than the full patch set.

Takeaway: The 7.1 MFA-bypass flaw drives the exploitation response, while the 8.8 management flaws permit unauthorized operations without credentials under specific conditions.

How does this fit the recent attack campaign?

SonicWall placed the warning after a string of attacks against its SMA1000 secure remote access appliances. The available disclosures do not show how many organizations the current flaw reached or what the attacks cost.

In October, researchers detected exploitation attempts against CVE-2026-102255. The maximum-severity flaw can let unauthenticated attackers access internal functionality and perform unauthorized operations.

Those October attempts followed September attacks that chained two SMA1000 zero-days for remote code execution. July attacks exploited two other zero-days to deploy malware on vulnerable appliances.

Takeaway: The new disclosure extends a 2026 run of SonicWall exploitation activity spanning July, September and October, including attempts against remote-access systems.

What should organizations do now?

CISA’s November 20, 2026 deadline applies to federal civilian executive agencies, but SonicWall urged all customers to upgrade “as soon as possible.” Operators should first determine whether their SSL-VPN uses SAML and whether their Gen7 or Gen8 build falls within the affected ranges.

The fixed releases are 7.3.4-7013 and 8.2.3-8015. Because the vendor offers no workaround, upgrading is the disclosed remediation path.

No customer count, attack volume or remediation-cost estimate appears in the public details. Organizations must therefore size their own exposure and patching effort rather than rely on a published impact total.

Takeaway: There is no vendor workaround or public scale-and-cost estimate; affected operators must identify SAML deployments, check versions and upgrade promptly.