(TLP:CLEAR) Vulnerability Notification – SonicWall Firewalls Actively Exploited

ACTION MAY BE REQUIRED for utilities using SonicWall Gen7 or Gen8 firewalls running SonicOS with SAML authentication enabled for SSL-VPN logins. Utilities that outsource technology support may need to consult their service providers for assistance with remediation actions.

Summary: An authentication bypass vulnerability affecting SonicWall SonicOS SSL-VPN is being actively exploited in the wild. Tracked as CVE-2026-19868 (CVSS 7.1), the vulnerability is exploitable only when SAML is enabled for SSL-VPN logins. Successful exploitation could allow an attacker to bypass SAML authentication controls, including any multi-factor authentication (MFA) enforced through SAML. CISA has added the vulnerability to its Known Exploited Vulnerabilities catalog.

Although exploitation requires valid credentials, stolen VPN credentials are widely available, and SAML-enforced MFA is often the control utilities rely on to render them useless. SonicWall SSL-VPN devices are a frequent target of ransomware-linked actors, including Akira affiliates in 2025. A successful bypass could give attackers a foothold inside trusted networks, potentially enabling lateral movement or access to systems supporting OT environments.

Affected Versions:

• Gen7 firewalls running SonicOS 7.3.3-7015 and older. Fixed in 7.3.4-7013 and higher.
• Gen8 firewalls running SonicOS 8.2.2-8015 and older. Fixed in 8.2.3-8015.

Gen6 firewalls are not listed as affected but have reached end of support. SonicWall advises customers running them to upgrade to Gen8.

WaterISAC strongly encourages members to update affected systems immediately according to SonicWall’s advisory, as no workarounds are available. WaterISAC also encourages members using SAML for SSL-VPN logins to:

• Review recent SSL-VPN logins for any that succeeded without a matching sign-in and MFA check in the identity provider’s logs.
• Reset credentials for any account that logged in this way, and review what was accessed during those sessions.

Additional Reading

• Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
• SonicWall PSIRT Advisory SNWLID-2026-0014

WaterISAC PIRs: 6, 8