If your business uses SonicWall firewalls with SSL-VPN — and in Columbus, a lot do — stop what you're doing and check your firmware versions. A vulnerability that bypasses your SAML and MFA login protections is being actively exploited in the wild right now.
🔴 The Short Version
CVE-2026-19868 is a SAML/MFA bypass vulnerability (CVSS 7.1) in SonicWall SonicOS. An attacker who can reach your SSL-VPN portal can skip your multi-factor authentication entirely. CISA added it to the Known Exploited Vulnerabilities catalog — this isn't theoretical, it's happening.
What's Affected
- SonicWall Gen7 firewalls running SonicOS 7.3.3-7015 or earlier
- SonicWall Gen8 firewalls running SonicOS 8.2.2-8015 or earlier
If you're running any firmware at or below those versions with SSL-VPN enabled, you're exposed.
The Fix
- Gen7: Update to SonicOS 7.3.4-7013 or later
- Gen8: Update to SonicOS 8.2.3-8015 or later
These patches are available now on MySonicWall.
But Wait, There's More
SonicWall also patched two additional vulnerabilities in the same update batch, both rated 8.8 severity — higher than the VPN flaw:
- CVE-2026-19869: Management interface authentication bypass
- CVE-2026-19870: Management interface remote code execution
These aren't confirmed exploited yet, but 8.8 CVSS scores with "authentication bypass" and "remote code execution" in the description should make the decision easy.
The Deadline
CISA's Binding Operational Directive gives federal agencies until November 20 to patch. If that timeline is good enough for agencies protecting national security infrastructure, Columbus businesses should treat it the same way.
Patch Tuesday Reminder
Microsoft's November Patch Tuesday is tomorrow (November 10). If you're already scheduling maintenance windows for SonicWall updates, stack your Microsoft patches in the same window.
Sources: BleepingComputer · CISA KEV Catalog · SonicWall PSIRT