WORLDTECHSonicWall ships fixes for seven SonicOS flaws, one SSL-VPN bypass already under attack
AI illustrationSonicWall has issued security updates for seven vulnerabilities in its SonicOS firewalls. Among them is an SSL-VPN authentication flaw that the company's own advisory suggests is being abused in live attacks, and which could let attackers slip past multi-factor authentication.
The weakness and how it is tracked
The most serious item is a flaw in how the SSL-VPN service enforces authentication. According to the disclosure, it could allow an attacker to get around SAML authentication and the multi-factor controls tied to it. The issue is catalogued as CVE-2026-19868 and carries a CVSS severity score of 7.1.
SonicWall's product security incident response team investigated a report pointing to possible exploitation. The resulting advisory, SNWLID-2026-0014, was published on November 6, 2026.
Signs of suspected misuse
The advisory's phrasing indicates that malicious activity is suspected, rather than describing a purely theoretical hazard. GBHackers Security, which reported the story, presents the flaw as being used in active attacks to bypass multi-factor authentication. The facts available here support the suspicion of exploitation but do not confirm the scale of any such attacks.
Open questions
- How many organisations have been affected by the suspected exploitation?
- Which SonicOS firewall models and firmware versions are covered by the updates?