Attackers Exploit SonicWall SonicOS SSLVPN Flaw CVE-2026-19868 in the Wild

TL;DR

Threat actors are exploiting a SonicWall SonicOS SSLVPN login bug in the wild to skip multi-factor checks. Tracked as CVE-2026-19868, the flaw led CISA to issue an urgent federal patch order alongside six other SonicOS fixes. Network admins must update Gen7 and Gen8 firewalls right away because no workarounds exist.

Notable CVEs

Why It Matters

SonicWall firewalls and SonicWall SonicOS SSLVPN gateways guard edge networks for hundreds of thousands of firms worldwide. However, attackers are now using CVE-2026-19868 in live network breaches. On November 6, 2026, CISA added the bug to its Known Exploited Vulnerabilities catalog due to active attacks.

In addition, the SonicWall SNWLID-2026-0014 security advisory confirms real-world abuse of this flaw. As the vendor warns, “Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks.” For the other six bugs in the report, neither source confirms any active attacks in the wild or public exploit code.

How the Attack Works

Exploited SAML and MFA Bypass (CVE-2026-19868)

First, CVE-2026-19868 (CVSS 7.1) stems from single-factor login use (CWE-308) in the SSLVPN service. Consequently, a user with valid login details for an alternate method can skip SAML checks. They can also bypass SAML multi-factor login rules. Moreover, the report states that “This vulnerability ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.”

Management Portal and Buffer Overflow Bugs

Second, the update fixes two high-risk bugs (CVSS 8.8) in the web admin portal. Specifically, CVE-2026-107155 involves a loose cross-domain policy (CWE-942), while CVE-2026-107154 stems from IP session checks (CWE-291). Both flaws let remote attackers run rogue tasks when certain settings are on.

Third, three pre-auth buffer overflows let remote attackers crash services. CVE-2026-82308 (CVSS 7.5) causes a heap overflow in SSL-VPN. Similarly, CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9) trigger stack and heap overflows in the TACACS+ client. Finally, CVE-2026-19703 (CVSS 5.2) lets local users read a limited password on virtual hosts due to weak hashing.

Affected Versions

These seven bugs hit SonicWall SonicOS SSLVPN and firewall appliances across Gen7 and Gen8 lines. Affected hardware and NSv virtual hosts include Gen7 models on SonicOS 7.3.3-7015 and older. They also include Gen8 models on 8.2.2-8015 and older.

Patch and Mitigation Steps

SonicWall states that no workarounds exist for these flaws. Therefore, admins must update Gen7 firewalls to SonicOS 7.3.4-7013 or higher right away. Likewise, teams must update Gen8 firewalls to 8.2.3-8015 or higher. Admins using SAML on SSLVPN should also check logs for logins that skipped MFA checks. Taking these steps will keep your edge network safe.

×

Support Our Threat Intelligence

Find our vulnerability reports and weekly recaps helpful? Support our work today and unlock a 100% ad-free reading experience!

Buy Me a Coffee

PayPal

Select your plan

Free Pro Team

Hover over a plan to see its benefits.

Written by

@DdoS · Security Researcher

Do Son

Do Son is the Founder and Editor of SecurityOnline.info. Working in cybersecurity since 2013, he reports on vulnerabilities, malware, and emerging threats, providing timely analysis to help organizations and individuals stay ahead of evolving risks.