SonicWall VPN Flaw Bypasses MFA as CISA Confirms Attacks
SonicWall has fixed a flaw in its SonicOS firewall software that lets an attacker bypass the login protections many organisations rely on most — including multi-factor authentication — and the US government says the flaw is already being exploited in the wild.
The vulnerability, tracked as CVE-2026-19868, sits in the SSL-VPN service that employees use to reach office systems from outside the network. It carries a severity score of 7.1 out of 10. An attacker who already holds valid credentials for an alternate login method can use the flaw to sidestep SAML authentication controls, including multi-factor authentication enforced through SAML, on SSL-VPN services set up to use SAML.
SonicWall published its advisory, SNWLID-2026-0014, on Friday 6 November. The same day, the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its Known Exploited Vulnerabilities catalogue, confirming exploitation in the wild, and ordered federal civilian agencies to patch by 20 November 2026.
A flaw that turns MFA into a suggestion
The weakness matters because multi-factor authentication is often the last line of defence once a password has been stolen. If an attacker can present credentials for a different login method and skip the SAML step entirely, the second factor never gets a chance to stop them.
SonicWall describes the flaw as an authentication enforcement problem in the SonicOS SSL-VPN service. The CVE record classifies it as CWE-308, use of single-factor authentication. Its scope is narrow but serious: it only affects SSL-VPN services configured to use SAML authentication, but those are common in corporate environments where single sign-on is standard.
SonicWall said its security team investigated a report indicating potential exploitation and urged customers to install the latest updates as soon as possible. The company has not published details about the reported attacks, and no victim count, named threat actor or attack details have been made public.
Who is affected, and what to install
The flaw affects SonicOS Gen7 versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier. The fixed versions are 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, or later. SonicWall says there is no workaround — patching is the only fix.
The flaw was reported by Ryan Harris of The Electronic Office. SonicWall’s advisory covers seven vulnerabilities in total. The other six include two management-interface issues rated 8.8 that could let unauthenticated attackers perform unauthorised operations under specific conditions, pre-authentication buffer overflows in SSL-VPN and TACACS+ that can cause denial of service, and a weak password-hashing issue on virtual appliances. Only CVE-2026-19868 is listed by CISA as exploited.
The Canadian Centre for Cyber Security also issued an alert on 6 November warning of exploitation and urging organisations to update.
A familiar target
SonicWall’s remote-access products have drawn attackers before. The company has dealt with attacks on its SMA1000 remote-access appliances in July, September and October, although SonicWall has said those flaws were unrelated to other SonicWall product vulnerabilities. The latest incident follows the same pattern: an internet-facing login service, a flaw that undermines authentication, and a rush to patch before exploitation spreads.
For administrators, the practical advice is blunt. Check whether SSL-VPN with SAML is in use, confirm the firmware version, and upgrade now rather than waiting for the next maintenance window. CISA’s 20 November deadline applies to federal civilian agencies, but it is a compliance date, not a sensible patching target for everyone else. The flaw is already being used, and there is no workaround to fall back on.
