SonicWall Patches Critical Vulnerability in VPN Login Process
Cybersecurity firm SonicWall has issued a critical patch to address a vulnerability in its SonicOS operating system that affects the Secure Sockets Layer (SSL) Virtual Private Network (VPN) component. The flaw, tracked as CVE-2026-19868, can be exploited by an attacker with valid credentials for another authentication method to bypass Single Sign-On (SAML) authentication controls and multi-factor authentication (MFA). This means that even if a user has enabled SAML-based login, they may still be vulnerable to unauthorized access.
The vulnerability affects SonicWall firewalls running SonicOS 7.3.3-7015 or older, as well as Gen8 TZ, NSa, and NSv firewalls with SonicOS 8.2.2-8015 or older. SonicWall has urged customers to upgrade to the latest version of SonicOS, which resolves the issue, as soon as possible to mitigate the associated risks.
The vulnerability was reported by Ryan Harris of The Electronic Office and assigned a CVSS score of 7.1, indicating high severity. SonicWall’s product security team investigated a report of potential exploitation of this vulnerability but has not shared any details about the suspected attacks.
It’s worth noting that this is not an isolated incident. Threat actors have been exploiting SonicWall product vulnerabilities in the past, and it’s essential for customers to stay up-to-date with the latest patches and updates. The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, which requires federal agencies to address the issue by November 20.
The vulnerability is particularly concerning because it affects the SSL VPN component of SonicOS, which is designed to provide secure access to a network. If exploited, an attacker could gain unauthorized access to sensitive data and systems. While SonicWall has patched the flaw, customers must take immediate action to protect themselves from potential attacks.
To stay safe, it’s essential for organizations using SonicWall firewalls to review their system configurations and ensure that they are running the latest version of SonicOS. Additionally, users should enable multi-factor authentication (MFA) whenever possible and regularly monitor their systems for signs of unauthorized access.
In conclusion, the recent patch from SonicWall addresses a critical vulnerability in its VPN login process. It’s crucial for customers to stay informed about potential security threats and take prompt action to protect themselves from attacks. By staying up-to-date with the latest patches and updates, organizations can minimize the risk of a successful cyber attack.
Source: SecurityWeek — 2026-11-07