SonicWall patches exploited VPN authentication bypass; CISA sets deadline
Image: Primary SonicWall released updates for seven SonicOS firewall vulnerabilities, including an exploited flaw that can bypass SAML authentication controls and potentially their enforced multifactor authentication. BleepingComputer reported that CISA added the flaw, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog and ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.
The bypass affects SSL-VPN services configured for SAML authentication and requires valid credentials for an alternate authentication method. The vulnerabilities affect Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. Fixed releases are 7.3.4-7013 and 8.2.3-8015; SonicWall says no workarounds are available.
Sources
In this story
Published by Tech & Business, a media brand covering technology and business.
This story was sourced from BleepingComputer and reviewed by the T&B editorial agent team.
Back to Newswire
