Ing. Calogero Bono
SonicWall has released updates for 7 vulnerabilities in SonicOS, the operating system of its firewalls. Italy's ACN, with its alert of November 9, 2026, reports that active exploitation attempts have been observed on the network for CVE-2026-19868. The flaw affects the SSLVPN service and can bypass SAML controls, including multi-factor authentication. It matters because the firewall is the gateway to your company network.
A few terms before we get into the facts. SonicOS is the operating system of SonicWall firewalls. SSLVPN is the service that lets you connect to the company network remotely. SAML is a single sign-on system that delegates login to an identity provider. MFA is multi-factor authentication, meaning a password plus a second check. CVSS is the score from 0 to 10 that measures how severe a flaw is.
What happened with SonicOS?
According to the ACN alert, the security updates fix 7 vulnerabilities, 4 of them rated high severity. Among these stands out CVE-2026-19868, for which the agency indicates exploitation in its CVE table.
The listed types are authentication bypass, denial of service and security restriction bypass. The bulletin is version 1.0, published on November 9, 2026.
How does CVE-2026-19868 work?
The flaw is of the Authentication Enforcement Bypass type and has a CVSS 3.1 score of 7.1. According to ACN it stems from inadequate enforcement of SAML authentication controls in the SSLVPN service.
Anyone holding valid credentials tied to alternative authentication methods could bypass the SAML controls. If MFA is enforced through SAML, it would be bypassed as well.
The Hacker News reports a score of 7.1 / 7.5 for the same flaw. The ACN text shows only 7.1.
Which SonicOS versions are affected?
ACN lists two branches.
- Gen7, version 7.3.3-7015 and earlier
- Gen8, version 8.2.2-8015 and earlier
The full product list is in the "Affected Product(s)" section of the vendor bulletin. ACN recommends updating promptly following those indications.
What are the other serious flaws and what does CISA say?
According to The Hacker News, the US agency CISA has added CVE-2026-19868 to the KEV catalog, the list of exploited vulnerabilities. Civilian federal agencies must apply the patches by November 20, 2026.
The other high-severity flaws are CVE-2026-107155 and CVE-2026-107154, both with CVSS 8.8 and in the management interface, and CVE-2026-82308 (CVSS 7.5), a pre-authentication buffer overflow in SSLVPN that can cause a denial of service.
The theme of firewalls under attack recalls the case of Cisco ASA and FTD, with a zero-day on the SSL VPN.
Limits to know
SonicWall, reports The Hacker News, investigated a report of possible exploitation and has not given details about the attack or who is behind it. We do not know how many devices have been hit. No public proof-of-concept exploits appear in the ACN table. The picture may change with new data from the vendor.
What changes for those working in digital
If your company uses a SonicWall firewall with SSLVPN, updating is the priority. Check your SonicOS version and compare it with the branches listed. Verify whether VPN access goes through SAML with MFA, because that is exactly the case at risk. Review recent remote access logs for unusual logins. If you entrust your servers to third parties, ask them to confirm their patching times, as you would with managed hosting with security updates.
Our take
The flaw is not the most severe in absolute terms, with a score of 7.1, but it hits the most sensitive point, namely MFA. Many companies consider it a guarantee, yet here everything depends on how it is configured. The risk remains limited to those who already hold valid credentials, but stolen credentials are a widespread habit. Behind it lies a recurring problem – perimeter devices are prime targets and get updated too late. Compared with other cases, such as Apache OFBiz, the message does not change.
Frequently asked questions
What is CVE-2026-19868?
It is a SonicOS flaw in the SSLVPN service. With valid credentials obtained through an alternative method, it allows bypassing SAML controls and the MFA enforced through SAML.
Is it already being exploited?
Yes, ACN reports active exploitation on the network. SonicWall speaks of a report of possible exploitation and gives no further details.
Which versions need updating?
Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015. For the full list you need the vendor's bulletin.
Is MFA enough to be safe?
No, not in this case. If MFA is enforced through SAML, the flaw can bypass that too.
What did CISA do?
It added the flaw to the KEV catalog. US civilian federal agencies must apply the patches by November 20, 2026.
What to watch in the coming weeks on SonicWall firewalls
The case is still evolving and details about the attack are missing. It is worth following the vendor's updates.
- Follow the SonicWall bulletin and the ACN alert, watching for a new revision with more details about the attack.
- Also check the handling of end-of-life products, such as the GMS systems mentioned by The Hacker News, to be replaced with NSM.
- Consider not relying on a single layer of control for remote access, adding checks beyond SAML.
