SonicOS Security Flaw Added to CISA Catalog Following Attacks

The US cybersecurity agency added a high severity SonicOS vulnerability to its catalog amid reports of real world exploitation. Federal networks face a strict compliance deadline to secure infrastructure against unauthorized access attempts.

SecurityWeek reported that the authentication enforcement issue, officially designated as CVE-2026-19868, carries a CVSS score of 7.1. The flaw targets the SSL VPN component running on SonicWall firewalls, specifically impacting systems where SAML based login is active. An attacker holding credentials for an alternate login method can bypass security controls and get past multi-factor authentication checks.

The Electronic Office researcher Ryan Harris originally discovered and reported the issue to the vendor. SonicWall disclosed the vulnerability as part of an advisory published on November 6, which detailed seven distinct security holes in total. The product security team investigated the incident after receiving reports indicating potential exploitation in active operations. SecurityWeek noted that it remains unclear whether threat actors utilized the bug as a zero-day before patches became available.

Also read: Control Web Panel Servers Targeted by Stealthy CWPdoor Backdoor

Following the vendor disclosure, the Cybersecurity and Infrastructure Security Agency placed the vulnerability into its Known Exploited Vulnerabilities catalog. Federal Civilian Executive Branch agencies are required under Binding Operational Directive 26-04 to address the exposure by November 20, 2026. SonicWall warned customers that no workarounds exist for the issue, urging administrators to update immediately to newer software versions.

Impacted hardware includes Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or older, alongside Gen8 TZ, NSa, and NSv units running SonicOS 8.2.2-8015 or older. Organizations can resolve the risk by upgrading to SonicOS versions 7.3.4-7013 and 8.2.3-8015. Neither the vendor nor federal authorities have publicly shared specific attribution details regarding who is behind the attacks or the exact nature of the weaponization.

Also read: Apple and WordPress Vulnerabilities Added to CISA Catalog

Background

The discovery of CVE-2026-19868 follows a series of recent security warnings concerning enterprise management infrastructure. SonicWall previously detailed two unpatched vulnerabilities impacting end-of-life Global Management System units, prompting users to transition toward Network Security Manager tools.

Beyond the SSL VPN bypass issue, the November advisory outlined six additional weaknesses in the SonicOS operating system. These extra flaws include management interface bugs, pre-authentication buffer overflows capable of triggering application level denial-of-service, and a weak password hashing issue affecting virtual appliances.

Also read: North Korea Denies Role in October 29 Binance Crypto Attack

Why It Matters

Vulnerabilities affecting perimeter network devices present significant risks because firewalls serve as the primary defensive barrier for corporate networks. When authentication mechanisms fail, malicious actors may gain unrestricted entry to internal enterprise resources, making timely firmware updates critical for maintaining organizational security posture.

Illustration: AI-generated image, not a photograph of the event.