SonicWall patches seven SonicOS flaws, including an SSL-VPN bypass exploited in attacks
SonicWall has released security updates fixing seven vulnerabilities in SonicOS firewalls. The item says one of them, an SSL-VPN authentication bypass, is being exploited in attacks.
Written by a model from the sources below. Verify against them.
- Kind
- Vulnerability
- Vendor
- SonicWall
- Product
- SonicOS
- Status
- Reported, not confirmed
- First seen
What to do
Apply the SonicOS security updates from SonicWall now
Review SSL-VPN logs for unexpected logins or authentication bypass activity
Restrict SSL-VPN access to trusted networks until patched
Timeline
- Made public by Mastodon2 days
- First seen by cve.now
Evidence 8
- SocialMastodon
“FAILLE CRITIQUE CVE-2026-19868 activement exploitée : utilisation d'une authentification à un seul facteur dans SonicWall SonicOS SSLVPN”
- SocialMastodon
“IMPORTANT: SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability.”
- SocialBluesky
“Zero-day · Newly listed by CISA: SonicWall SonicOS SSLVPN”
- SocialMastodon
“CISA lists this as actively exploited, so treat it as urgent.”
- PressBleepingComputer on Bluesky
“SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw exploited in attacks.”
Show all 8 sourcesShow fewer sources
- SocialMastodon
“Patch SonicOS within 24 to 48 hours — that is not a suggestion, that is the final scene before the credits roll and your data walks out wearing a trench coat.”
- SocialMastodon
“SonicWall has patched seven vulnerabilities in SonicOS, including an actively exploited flaw (CVE-2026-19868) that allows attackers to bypass SAML-based MFA on SSL VPNs.”
- SocialMastodon
“SonicWall reports two vulnerabilities in its End-of-Life Global Management System (GMS), including a critical unauthenticated file read flaw (CVE-2026-109593).”
Corrections
None so far.
Something wrong on this page? Report an error. Every fix is listed here.
Questions about SZB-4458e05e7c
Has SonicWall confirmed it?
Mastodon, Mastodon and Bluesky report a possible compromise. None of the sources says it happened. No statement from SonicWall has reached cve.now yet.Source: Mastodon, Mastodon, Bluesky, Mastodon, BleepingComputer on Bluesky, Mastodon, Mastodon, Mastodon
What should SonicWall users do?
Apply the SonicOS security updates from SonicWall now. Review SSL-VPN logs for unexpected logins or authentication bypass activity. Restrict SSL-VPN access to trusted networks until patched.