Ce qui s’est passé
SonicWall released updates for seven SonicOS vulnerabilities, the most critical being CVE‑2026‑19868 (CVSS 7.1). The flaw allows attackers with valid alternate credentials to bypass SAML‑enforced MFA on SSL‑VPN services. CISA added the CVE to its Known Exploited Vulnerabilities catalog after confirming active exploitation. No work‑arounds exist; customers are urged to upgrade to SonicOS 7.3.4‑7013 or 8.2.3‑8015. The advisory also patches two unauthenticated management‑interface bugs (CVSS 8.8) and several pre‑auth buffer overflows.
Pourquoi c’est important pour la confiance et la conformité
- The exploit demonstrates why continuous verification of MFA and SAML authentication controls is essential for a defensible access‑control posture.
- Validate that MFA enforcement cannot be bypassed via alternate credential paths.
- Collect patch‑deployment evidence and authentication‑log records for audit readiness.
Who is affected
Enterprises using SonicWall SSL‑VPN appliances Managed service providers deploying SonicOS firewalls Government agencies with mandated CISA compliance
Recommended actions
- Apply the SonicOS security updates immediately.
- Review and harden SAML and MFA configurations.
- Enable detailed VPN authentication logging and set up alerts for anomalous logins.
- Map the MFA control to your audit framework and capture evidence of remediation.