SonicWall issues fixes for seven vulnerabilities – including an SSL-VPN flaw that bypasses MFA
The vulnerability, which appears to have been exploited in the wild, comes alongside six others
SonicWall has issued fixes for seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw that has been actively exploited in the wild.
The SSL-VPN vulnerability, tracked as CVE-2026-19868, carries a CVSS score of 7.1, and could allow attackers to bypass SAML authentication and its multi-factor authentication (MFA) checks. An SSL VPN is exposed only if SAML-based login is enabled.
“An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls," the SonicWall advisory reads.
"Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).”
Notably, SonicWall warned that the vulnerability has been spotted in the wild and has investigated a report "indicating potential exploitation”. It didn't give any further information about which organizations might have been hit and what may have happened as a result.
The vulnerability has been added to CISA's Known Exploited Vulnerabilities (KEV) Catalog, with CISA confirming that it's been exploited in the wild. Agencies are directed to address the flaw by November 20.
"This type of vulnerability is a frequent attack vector for malicious cyber actors and poses significant risks to the federal enterprise," the agency warned.
Sign up today and you will receive a free copy of our Future Focus 2026 report - the leading resource for IT decision-maker insight on priorities and investment areas in AI, security and more.
SonicWall patches six more flaws
The advisory also covers six further vulnerabilities in SonicOS. CVE-2026-107155, with a CVSS score of 8.8, is a permissive cross-domain policy vulnerability in the SonicOS management interface.
In certain circumstances, SonicWall said this could enable a remote unauthenticated attacker to perform unauthorized operations.
CVE-2026-107154, with a CVSS score of 8.8, is a session validation vulnerability in the SonicOS management interface that could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Other vulnerabilities highlighted in the advisory include:
- CVE-2026-82308: A pre-authentication heap-based buffer overflow vulnerability that could enable a remote unauthenticated attacker to cause an application-level denial of service (CVSS score of 7.5)
- CVE-2026-77708: A pre-authentication stack-based buffer overflow vulnerability in the SonicOS TACACS+ authentication client (CVSS score of 5.9)
- CVE-2026-77709: A pre-authentication heap-based buffer overflow vulnerability in the SonicOS TACACS+ authentication client (CVSS score of 5.9)
- CVE-2026-19703: A weak password hashing vulnerability identified on SonicOS virtual appliances (CVSS score of 5.2)
The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier, along with Gen8 versions 8.2.2-8015 and earlier.
SonicWall said it has fixed the issues in versions 7.3.4-7013 and 8.2.3-8015, and that no workarounds are available. Organizations are advised to update as quickly as possible.
FOLLOW US ON SOCIAL MEDIA
Follow ITPro on Google News and add us as a preferred source to keep tabs on all our latest news, analysis, views, and reviews.
You can also follow ITPro on LinkedIn, X, Facebook, and BlueSky.
Emma Woollacott is a freelance journalist writing for publications including the BBC, Private Eye, Forbes, Raconteur and specialist technology titles.
-
Checkmarx names Kobi Sivilya as new chief information security officerNews Sivilya will oversee Checkmarx’s corporate security and IT functions as the security vendor targets further growth
-
OpenAI says its new cyber-focused AI model found thousands of Linux kernel vulnerabilitiesNews The new cyber-focused AI model boasts improved bug hunting capabilities compared to its predecessor
-
Accenture contractor removed over blunder in lead up to FBI breachNews The contractor is believed to have failed to apply a security patch that would have secured Oracle PeopleSoft
-
Why Microsoft paused Patch Tuesday updates for some Dell devicesNews Select devices running Intel Innovation Platform Framework drivers encountered “poor performance”
-
Threat actors ditch ‘spray and pray’ attacks in shift to targeted exploitationNews A dip in ransomware volumes points to a more targeted approach focused on vulnerability exploitation
-
Microsoft patches six zero-days targeting Windows, Word, and more – here’s what you need to knowNews Patch Tuesday update targets large number of vulnerabilities already being used by attackers
-
IBM AIX users urged to patch immediately as researchers sound alarm on critical flawsNews Network administrators should patch the four IBM AIX flaws as soon as possible
-
SonicWall launches new firewalls as part of Generation 8 refreshNews The vendor’s latest update includes unified management and integrated ZTNA, backed by embedded warranty and co-managed services
-
SonicWall CEO Bob VanKirk hails ‘pivotal moment’ as firm unveils new MSP cyber solutionsNews The company is expanding its MSP solutions range and ramping up its focus on platform-based security
-
Vulnerability management complexity is leaving enterprises at serious riskNews Fragmented data and siloed processes mean remediation is taking too long