--- title: "SonicOS: seven flaws patched, one an MFA bypass attackers already use" description: "SonicWall patched seven SonicOS flaws on 6 November, including an already-exploited bypass of SSL-VPN SAML authentication. If your VPN relies on SAML to enforce MFA, that second factor may not be enough until the firewall is updated." canonical: https://inyourgeek.com/en/articles/2026-11-07-sonicos-sept-failles-corrigees-dont-un-contournement-mfa-deja type: article author: "Sébastien Soulier" publisher: "InYourGeek" language: en datePublished: 2026-11-07 dateModified: 2026-11-07 section: "Security" tags: ["sonicwall", "vpn", "mfa", "cisa"] --- # SonicOS: seven flaws patched, one an MFA bypass attackers already use > SonicWall patched seven SonicOS flaws on 6 November, including an already-exploited bypass of SSL-VPN SAML authentication. If your VPN relies on SAML to enforce MFA, that second factor may not be enough until the firewall is updated. November 7, 2026 · Security · 3 min On Friday 6 November 2026, SonicWall published a security advisory fixing seven vulnerabilities in SonicOS, the operating system that runs its firewalls. One of them, CVE-2026-19868, has already been exploited in at least one attack. Everything below comes from a single source, [Bleeping Computer](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/), which reports the vendor's advisory and the flaw's addition to CISA's catalogue. ## Two-factor authentication, minus a factor CVE-2026-19868 affects the SonicOS SSL-VPN service, but only when it is set up to authenticate users through SAML. In that case, an attacker who holds valid credentials for another authentication method can get past the SAML checks. They may also get past the multi-factor authentication (MFA) that SAML enforces. Put simply, the MFA tied to your identity provider no longer proves, on its own, that the person on your VPN actually passed it. The bouncer is still guarding the front door. Someone has just found the fire exit. The flaw scores 7.1 on the CVSS scale. Don't let that middling score push it down your to-do list. SonicWall's product security incident response team (PSIRT) says it investigated a report of possible exploitation, and the vendor is urging customers to update as soon as possible. It has given no details about the attack. CISA, the US cybersecurity agency, has also added the flaw to its Known Exploited Vulnerabilities (KEV) catalogue, which confirms real-world exploitation. CISA requires federal civilian agencies to patch their systems by 20 November 2026. ## Six more flaws in the same patch The 6 November advisory also fixes: - two flaws in the management interface, rated 8.8, which under certain conditions let an unauthenticated attacker carry out unauthorised operations; - pre-authentication buffer overflows in the SSL-VPN and TACACS+ services, which can cause a denial of service; - password hashing that is too weak on the virtual appliances. The two management-interface flaws score higher than the one already being exploited. "Nobody has used them yet" is not a patching strategy, so don't leave them for later. ## Affected versions and what to install - **SonicOS Gen7**: versions 7.3.3-7015 and earlier are affected. The fix is in **7.3.4-7013**. - **SonicOS Gen8**: versions 8.2.2-8015 and earlier are affected. The fix is in **8.2.3-8015**. Read those numbers carefully, because they are designed to trip you up. On Gen7, the fixed release has a lower build number (7013) than the last vulnerable one (7015). The version number is what counts: 7.3.4 beats 7.3.3, whatever the build suffix says. SonicWall says there is no workaround. Only the update protects you. ## What you can check So far, SonicWall has published neither indicators of compromise nor a description of the reported attack, so there is no official signature to search your logs for. You can still use the conditions in the advisory to narrow down what to check: - find out whether your SSL-VPN uses SAML authentication: it is the only configuration exposed to CVE-2026-19868; - record the SonicOS version of every firewall, virtual appliances included; - in the SSL-VPN logs, look at sessions opened with an authentication method other than SAML, since that is the path the flaw uses. If an account is supposed to go through SAML and logged in another way, someone should be able to explain why; - if you find logins like that, the credentials used may have been stolen: reset them, as well as updating. This alert follows a run of attacks on the vendor's SMA1000 remote-access appliances. In July, two zero-days were used to install malware on them. In September, two more were chained together to run code remotely. And in October, researchers spotted attempts to exploit CVE-2026-102255, a maximum-severity flaw. This time the firewalls themselves are the target, and the MFA meant to protect their VPN no longer does the job by itself. Until your boxes are patched, treat the update as your real second factor. If you run SAML, the code on your phone is, for now, partly decorative. ## Sources - [SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks](https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/) — bleepingcomputer.com _Article written with AI assistance from the cited sources, reviewed and approved by a human before publication._ --- Equivalent HTML page : https://inyourgeek.com/en/articles/2026-11-07-sonicos-sept-failles-corrigees-dont-un-contournement-mfa-deja Published by InYourGeek — https://inyourgeek.com/en/a-propos Method and safeguards : https://inyourgeek.com/en/methode All articles : https://inyourgeek.com/en/archives