SonicWall SSL-VPN flaw CVE-2026-19868 gets past two-factor login and is being exploited
SonicWall's advisory SNWLID-2026-0014 fixes CVE-2026-19868 in the SSL-VPN of SonicOS. It only affects SSL-VPN set up to use SAML sign-in. An attacker holding valid credentials for another login method can get past SAML controls, which can include two-factor checks. It affects SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. SonicWall says it investigated a report of possible exploitation and that there are no workarounds. CISA added the flaw to its list of exploited flaws on 6 November, with a deadline of 20 November for US federal agencies. The same advisory fixes six other flaws, which aren't listed as exploited.
Timeline
-
HARD publishes its alert, at High.
What to do
- Update the SonicWall firewall to SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8).
- If it can't be done today, consider switching off SSL-VPN until it is.
- Ask your IT provider to check VPN logins since October for sign-ins you don't recognise, and to rotate passwords for accounts that use the VPN.
- Home and small-office setups that don't use SAML sign-in on the VPN aren't in the affected configuration.
Related
Situations
- Plex Media Server under attack: update to 1.43.3.10861 or newer now Software flaw, critical, 28 Oct 2026
- Synology storage devices hit by ransomware; DSM updates available Software flaw, high, 6 Nov 2026
- Russian-linked hackers hit iPhones and Android phones through websites, but only phones missing updates Software flaw, high, 5 Nov 2026
- Apple brings its fix for an exploited flaw to the iPhone XS, XS Max, XR and seventh-generation iPad Software flaw, high, 4 Nov 2026
- Every situation, in the Situation Room
Flaws
- CVE-2026-19868 Attackers are using a flaw in SonicWall SonicOS SSLVPN.
Companies
- SonicWall every SonicWall flaw being used in attacks
References
- BleepingComputer, citing SonicWall advisory SNWLID-2026-0014 (). “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks”.
- SonicWall (). “SonicWall PSIRT advisories”.
Situation Room articles are updated as events develop: updates are added to the timeline, and never edited away. Follow them by email or RSS.