SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
A credential leak at SSL-VPN is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
A credential leak at SSL-VPN is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA).
In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates.
SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.
Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks, the company warned.
Anyone connected to SSL-VPN through the compromised trust relationship is potentially affected, not just SSL-VPN itself.
CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.
The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier.
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
The advisory also fixes six further vulnerabilities in SonicOS, including two management interface flaws rated 8.8 severity that allow unauthenticated attackers to perform unauthorized operations under specific conditions.
The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password hashing vulnerability affecting virtual appliances.
The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.
The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication.
Ryan Harris of The Electronic Office discovered and reported the vulnerability.
SSL-VPN says the credential has been revoked, and no exploitation has been confirmed so far.
SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.
Those attempts followed September attacks that chained two SMA1000 zero-days to achieve remote code execution, as well as July attacks that exploited two other zero-days to deploy malware on vulnerable appliances.
If you have any integration or dependency involving SSL-VPN, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.
What happened
A credential leak at SSL-VPN is now a trust-relationship problem between its systems and connected services, not just a contained internal issue.
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.
The vulnerability, tracked as CVE-2026-19868, allows attackers with valid credentials for an alternate authentication method to bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication (MFA).
What changed
In a security advisory published Friday, SonicWall warned that it had investigated a report that the vulnerability was exploited in an attack and urged customers to install the latest security updates.
SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.
Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks, the company warned.
Who is affected
Anyone connected to SSL-VPN through the compromised trust relationship is potentially affected, not just SSL-VPN itself.
CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.
The vulnerabilities affect SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier.
Why it matters
A leaked key doesn't need an exploit to be dangerous -- it just needs to still work before someone notices and revokes it.
The advisory also fixes six further vulnerabilities in SonicOS, including two management interface flaws rated 8.8 severity that allow unauthenticated attackers to perform unauthorized operations under specific conditions.
The remaining flaws include pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions, and a weak password hashing vulnerability affecting virtual appliances.
Technical details
The trust mechanism involved here is a federated identity (SSO/SAML) trust relationship, which is what let access move between otherwise unrelated systems.
The flaw has a CVSS severity score of 7.1 and only affects SonicOS SSL-VPN services configured to use SAML authentication.
Ryan Harris of The Electronic Office discovered and reported the vulnerability.
Response
SSL-VPN says the credential has been revoked, and no exploitation has been confirmed so far.
SonicWall fixed the issues in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.
Those attempts followed September attacks that chained two SMA1000 zero-days to achieve remote code execution, as well as July attacks that exploited two other zero-days to deploy malware on vulnerable appliances.
What security teams should do
If you have any integration or dependency involving SSL-VPN, rotate any credentials shared with it as a precaution, even without confirmation you were directly affected.
Your own credential inventory is worth auditing for keys or tokens with broader access than they actually need -- the same blast-radius problem applies to anything your own organization leaks.