SonicWall released SonicOS updates after an authentication vulnerability was used in attacks. The issue affects remote-access services using SAML sign-in and can undermine its multifactor checks. Canada’s cyber agency relayed the warning. Covered US federal civilian agencies face a November deadline to fix affected systems; the vendor lists no workaround.
SonicWall, the firewall software maker, released fixes for SonicOS after CVE-2026-19868 was used in attacks. The Canadian Centre for Cyber Security, Canada’s national cyber agency, separately relayed the exploitation warning. The updates address seven vulnerabilities in the same software family.[1], [2]
The exploited issue concerns SSL-VPN, an encrypted remote-access service, when configured for SAML, a method of passing sign-in information between systems. It can undermine SAML-enforced multifactor authentication. SonicWall rates its severity at 7.1. The vendor investigated a report of possible exploitation; the number of affected organizations and the attackers’ identities remain undisclosed.[1]
The US Cybersecurity and Infrastructure Security Agency added the flaw to its exploited-vulnerability catalogue on November 6. Covered federal civilian agencies must remediate by November 20. SonicWall lists no workaround. Fixes are available for the affected Gen7 and Gen8 product lines. The same update also addresses management-interface weaknesses, service interruptions and weak password hashing in virtual appliances; those other flaws are not all described as exploited.[1]
