Skip to content
securitytabs

LiveUpdated

SonicWall patches exploited login weakness in SonicOS VPN

SonicWall says attackers are exploiting a weakness in the remote-access VPN of its SonicOS firewalls that can weaken login checks. Organizations using these firewalls should update to the fixed versions now.

SonicWall SonicOS VPN login weakness exploited in attacks
SonicWall SonicOS VPN login weakness exploited in attacks

What's new

Newest coverage

TimelineWhat should my organization do?

Vulnerabilities

What happened

CISA added CVE-2026-19868, a SonicWall SonicOS SSLVPN flaw involving single-factor authentication, to its Known Exploited Vulnerabilities (KEV) catalogue, its list of flaws attackers are using, on November 6. NVD rates it 7.5 on the CVSS severity scale. [1][2]

SecurityWeek reports that the flaw can let an attacker who holds credentials for a different login method get past SAML checks, including SAML-enforced multi-factor authentication. [3]

Exploitation and fixes

SonicWall indicates that CVE-2026-19868 is being exploited. Affected are SonicOS versions prior to 7.3.4-7013 and prior to 8.2.2-8015. CISA set a federal due date of November 20 for agencies to apply mitigations. [4][1]

It is not yet known from the sources who is exploiting the flaw or how many devices are affected. CISA lists known ransomware use as unknown. [1][4]

Timeline

  1. SonicWall's patch for the exploited SonicOS flaw was reported as available. [3]

  2. SonicWall indicated the flaw is being exploited and listed affected SonicOS versions. [4]

  3. CISA added CVE-2026-19868 to its KEV catalogue. [1]

Explained

The technology and terms in this story. Learn more

Why it was possible

The weaknesses behind this story's CVEs, from each CVE Record.

Business ActionWhat this means inside your organization, and what to do about it, by company size.

Small business

No dedicated security staff; relies on providers

What to know

If your business uses a SonicWall firewall for remote access, it may be affected, and SonicWall says the flaw is being exploited. [4]

What to do

  1. Ask your IT provider whether your SonicWall runs SonicOS 7.3.4-7013 or 8.2.2-8015 or later. [4]
  2. Ask your provider to apply the fixed SonicOS version if it is not yet installed. [3]

Mid-size company

A small IT or security team

What to know

SonicOS versions prior to 7.3.4-7013 and 8.2.2-8015 are affected, and the flaw can weaken SAML-based VPN logins. [4][3]

What to do

  1. Inventory SonicWall devices and update SonicOS to the fixed versions. [4]
  2. Check SonicWall's own advisory for vendor guidance. [4]

Large enterprise

A security operations team

What to know

CISA's KEV listing gives federal agencies until November 20 to act; the same exploitation evidence applies to any organization running SonicOS. [1]

What to do

  1. Find all SonicOS SSLVPN deployments and patch to the fixed versions. [4]
  2. Review VPN login logs for unusual SAML or credential activity since the flaw became known. [3]

Sources

  1. [1]CISA Advisories · Nov 6, 12:00 UTC
    CISA Adds One Known Exploited Vulnerability to Catalogcontext
  2. [2]Security Affairs · Nov 7, 09:09 UTC
    U.S. CISA adds SonicWall SonicOS SSLVPN flaw to its Known Exploited Vulnerabilities catalogcontext
  3. [3]SecurityWeek · Nov 7, 10:16 UTC
    SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Loginscontext
  4. [4]Canadian Centre for Cyber Security · Nov 6, 21:00 UTC
    SonicWall security advisory (AV26-1133)context