SonicWall firewall flaw lets attackers skip the second login step

SonicWall has fixed a flaw in its firewalls that attackers are already using in real attacks. The flaw can let someone get around a certain kind of sign-in on the company's remote-access VPN, including, in some cases, the second login step known as multi-factor authentication. SonicWall released updates for seven problems in total, and this is the one to treat as urgent.

What changed

The flaw is tracked as CVE-2026-19868 and has a severity score of 7.1. According to the advisory, an attacker who holds valid credentials for an alternate sign-in method can bypass SAML controls. SAML is a way of letting a company's central login system approve who gets in. Those controls can include the multi-factor checks tied to it.

SonicWall said it investigated a report of exploitation and strongly urged customers to upgrade as soon as possible. It has not shared details of the attack. The US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its list of known exploited vulnerabilities, which confirms it has been used in the wild.

Who it affects

This flaw only affects the SSL-VPN remote-access service when it is set up to use SAML sign-in. If your business does not use SAML for remote access, this particular bug does not apply to you. The affected software is SonicOS Gen7 version 7.3.3-7015 and earlier, and Gen8 version 8.2.2-8015 and earlier.

Relaxing completely is not wise, though. The same update fixes six other problems in those versions:

• Two management interface flaws rated 8.8, which let unauthenticated attackers perform unauthorized operations under specific conditions.
• Buffer overflows in the SSL-VPN and TACACS+ services that could cause denial-of-service conditions.
• A weak password hashing flaw affecting virtual appliances.

What to do

The fixed versions are 7.3.4-7013 and 8.2.3-8015. SonicWall says no workarounds are available, so updating is the only real fix. The steps in the alert box above lay out what to check and what to tell your IT provider.

What happens next

CISA has ordered US federal civilian agencies to secure affected systems by November 20, 2026. Private businesses have no such order, but that date shows how seriously the government takes the risk. Ryan Harris of The Electronic Office discovered and reported the flaw.

The warning follows a run of attacks on a different SonicWall product line, the SMA1000 remote-access appliances. Exploitation attempts in October targeted CVE-2026-102255, a maximum-severity flaw. They followed September attacks that chained two zero-days and July attacks that used two others. Zero-days are flaws attackers use before a fix exists. It is not yet known how widely the new SonicOS flaw has been used.