SonicWall SSL-VPN Flaw Bypasses Multi-Factor Authentication and Is Added to CISA Known Exploited Vulnerabilities Catalog

black laptop computer turned on with green screen — Moritz Erken / Unsplash

A high-severity vulnerability in SonicWall firewall operating systems allows attackers to bypass multi-factor authentication, and the flaw has been confirmed as exploited in real-world cyber attacks. The United States Cybersecurity and Infrastructure Security Agency added the issue to its Known Exploited Vulnerabilities catalog following the discovery.

The vulnerability is tracked as CVE-2026-19868 and carries a Common Vulnerability Scoring System score of 7.1. It affects the SSL-VPN service within SonicOS, the operating system for SonicWall firewalls. The flaw enables an authentication control bypass. An attacker who has obtained valid account credentials from another authentication method can use them to circumvent the Security Assertion Markup Language authentication procedure. This allows the attacker to establish a connection to the virtual private network.

The critical nature of the flaw lies in its ability to defeat multi-factor authentication protections. Even if an organization has implemented multi-factor authentication based on Security Assertion Markup Language, the authentication procedure is not enforced correctly. Consequently, the multi-factor authentication protection function can be bypassed. This creates a risk that attackers can use stolen account information to gain access to corporate internal networks. However, the vulnerability does not allow unauthenticated access for anyone without credentials. A successful attack requires valid credentials from another authentication method. The impact is limited to environments where Security Assertion Markup Language authentication is enabled for the SSL-VPN service.

SonicWall announced a security advisory on November 6 and stated it was investigating reports of possible exploitation. The vulnerability was discovered and reported by Ryan Harris of The Electronic Office. SonicWall reported that it investigated indications that the flaw might be exploited in actual attacks. The company urged customers to apply the latest security updates promptly. On the same day, the Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to the Known Exploited Vulnerabilities list. This registration signifies that evidence of exploitation in real-world attacks has been confirmed.

Details regarding the identity of the attackers, the targeted organizations, the scale of the damage, and the specific infiltration methods have not been disclosed. It remains unconfirmed whether the attacks were zero-day exploits that occurred before a patch was distributed. The affected products include SonicWall TZ, NSa, NSsp, and NSv series firewalls that run vulnerable versions of SonicOS. SonicOS Gen7 versions 7.3.3-7015 and earlier are affected and must be updated to version 7.3.4-7013 or later. SonicOS Gen8 versions 8.2.2-8015 and earlier are vulnerable and must be updated to version 8.2.3-8015 or later.

SonicWall emphasized that no official temporary workarounds are available, making the application of security updates necessary. The Cybersecurity and Infrastructure Security Agency required United States federal civilian agencies to complete remediation for this vulnerability by November 20. The security update also addresses six other vulnerabilities. Two of these have a Common Vulnerability Scoring System score of 8.8 and occur in the firewall management interface. Under specific conditions, these flaws allow unauthenticated attackers to perform unauthorized actions. Organizations should verify their use of Security Assertion Markup Language authentication for SSL-VPN and check their SonicOS versions. Administrators should compare virtual private network connection logs with Security Assertion Markup Language authentication records to identify abnormal successful connections that occurred without multi-factor authentication procedures.