SonicWall has released updates for its SonicOS firewall software that fix seven security flaws. The most urgent one affects the SSL-VPN feature, which lets employees connect securely to the office network from home or on the road.
The flaw, tracked as CVE-2026-19868, only matters if your SSL-VPN is set up to use SAML authentication. SAML is a way of signing in through a central identity service, and it is often used to enforce multi-factor authentication (MFA), the extra code or approval step after a password. An attacker who already has valid credentials for a different sign-in method could use this flaw to skip those SAML controls, possibly including MFA. SonicWall said it investigated a report of the flaw being exploited, and the U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added it to its list of vulnerabilities known to be used in real attacks.
The update also fixes two serious flaws in the firewall management interface that could let attackers without a login perform unauthorized actions under certain conditions. Other fixes address bugs that could crash the SSL-VPN and TACACS+ services and a weak password storage issue in virtual appliances.
Affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. The fixed versions are 7.3.4-7013 and 8.2.3-8015. SonicWall says there are no workarounds, so updating is the only fix. This comes after a string of attacks this year on other SonicWall remote access products, which shows these devices are a popular target.
What you should do
- Check whether your office uses a SonicWall firewall and which SonicOS version it runs.
- Install SonicOS 7.3.4-7013 or 8.2.3-8015 or later as soon as possible.
- Review VPN sign-in logs for unfamiliar logins or access at unusual times.
- Make sure the firewall management interface is not reachable from the internet.
- Ask your IT provider, such as Computech, to confirm the update was applied and your VPN settings are secure.
Computech prepares these summaries with AI assistance, based on public news reports. See the original report for full details.
