SonicWall SSL‑VPN MFA Bypass (CVE‑2026‑19868) Exploited in the Wild
What Happened — SonicWall disclosed seven vulnerabilities in SonicOS firewalls, the most critical being CVE‑2026‑19868 (CVSS 7.1). The flaw lets an attacker who possesses valid credentials for an alternate authentication method bypass SAML‑based MFA controls on SSL‑VPN services. CISA added the CVE to its Known Exploited Vulnerabilities (KEV) catalog after confirming active exploitation. SonicWall’s advisory urges immediate upgrade to the patched releases (7.3.4‑7013, 8.2.3‑8015). No work‑arounds exist. The same advisory also fixes six other flaws, including two unauthenticated management‑interface bugs (CVSS 8.8) and pre‑auth buffer overflows.
Why It Matters for Trust & Control Assurance — The incident highlights the need for continuous verification that MFA and SAML authentication controls cannot be bypassed, a core access‑control objective.
Who Is Affected — Organizations that deploy SonicWall SSL‑VPN appliances (enterprises, service providers, government agencies).
Recommended Actions
- Apply the SonicOS patches immediately on all affected versions.
- Review SAML and MFA configurations to ensure no alternate authentication paths exist.
- Enable logging and alerting for VPN authentication failures and anomalous credential use.
- Conduct a control‑mapping exercise to evidence MFA enforcement for audit readiness.
Technical Notes
- Vulnerability: CVE‑2026‑19868, CVSS 7.1, affects SonicOS Gen7 7.3.3‑7015 and earlier, Gen8 8.2.2‑8015 and earlier.
- Attack vector: exploitation of authentication bypass via valid alternate credentials.
- Exploited in the wild; listed in CISA KEV.
- Additional fixes: two CVSS 8.8 management‑interface bugs, pre‑auth buffer overflows, weak password hashing.
Source: BleepingComputer article