Key facts
- October exploitation attempts targeted CVE-2026-102255, a maximum-severity flaw in SMA1000 appliances that lets unauthenticated attackers reach internal functions and carry out unauthorized actions.
- SonicWall disclosed that CVE-2026-19868, an SSL-VPN authentication bypass flaw in SonicOS firewalls, is under active in-the-wild exploitation, and issued security updates fixing seven vulnerabilities.
- CVE-2026-19868 lets an attacker holding valid credentials for a different authentication method bypass SAML controls, potentially including SAML-enforced MFA.
- Ryan Harris of The Electronic Office discovered and reported CVE-2026-19868.
SonicWall disclosed on Nov. 7, 2026, that CVE-2026-19868 is under active in-the-wild exploitation, and the vendor issued security updates fixing seven vulnerabilities. The flaw is an SSL-VPN authentication bypass in SonicOS firewalls.
An attacker with valid credentials for another method can bypass SAML controls through CVE-2026-19868, potentially including SAML-enforced multifactor authentication. SAML is an authentication standard used to verify identity across services. The flaw carries a CVSS score of 7.1 and applies solely to SonicOS SSL-VPN services set up to use SAML authentication. Ryan Harris of The Electronic Office discovered and reported the vulnerability.
The flaw exposes Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier. Fixes arrived in releases 7.3.4-7013 and 8.2.3-8015, and the vendor says no workarounds exist.
SonicWall PSIRT investigated a report of possible exploitation and pressed customers to upgrade without delay. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, confirming in-the-wild exploitation. Agencies in the federal civilian executive branch must secure affected systems by the CISA deadline of Nov. 20, 2026.
The advisory fixes six more SonicOS vulnerabilities, including two management interface flaws scored at 8.8 that allow unauthenticated attackers to perform unauthorized actions in specific situations. Other patched issues are buffer overflows before authentication within the SSL-VPN and TACACS+ services, potentially leading to denial-of-service conditions. TACACS+ is an authentication protocol for network access. Weak password hashing affecting virtual appliances is another patched flaw.
Exploitation attempts in October targeted CVE-2026-102255, a maximum-severity flaw in SMA1000 appliances. It lets attackers without authentication access internal functions and take unauthorized actions.
CVE-2026-102255 carries a rating of 10 and is a server-side request forgery flaw in the SMA1000 Work Place interface exploitable before authentication. The vulnerable models include 6210, 7210, and 8200v in the SMA 1000 line, running versions 12.4.3-03526 and 12.5.0-02952 and earlier; fixed releases include 12.4.3-03670 and 12.5.0-03082 or later. At its October disclosure, SonicWall said there was no evidence of active exploitation for CVE-2026-102255, and the SMA1000 flaws do not affect SSL-VPN on SonicWall firewalls or the SMA 100 Series.
Attacks in September combined two SMA1000 zero-days to achieve remote code execution. In July, attackers used two different zero-days to plant malware on vulnerable appliances. CISA’s actively exploited list now includes 19 SonicWall vulnerabilities added over the last four years. Ransomware attacks targeted 13 of those vulnerabilities, and SonicWall SSL VPN customers bore the brunt.
The internet-facing VPN appliance is the Achilles’ heel of the perimeter, according to Frank Dickson, a principal analyst at Dickson Research. “CVSS only awards a 10.0 when everything goes the attacker’s way.” Dickson said to verify the full build on every appliance and to keep the workplace interface and management console away from the open internet if possible.
Attacks on SonicWall appliances are a documented business practice for Akira. The At-Bay 2026 InsurSec Report puts SonicWall appliances in 86% of Akira attacks.
Marquis Software Solutions sued SonicWall in U.S. District Court in Feb. 2026 over a MySonicWall cloud backup breach from 2025. The 2025 breach disrupted 74 U.S. banks and exposed data belonging to more than 400,000 individuals.
On May 19, 2026, ReliaQuest confirmed that patched SonicWall Gen6 SSL-VPN appliances remained fully exposed to the CVE-2024-12802 MFA bypass. The exposure persisted because fixing it required six manual configuration steps beyond updating the firmware. Gen6 SSL-VPN appliances reached end-of-life on April 16, 2026, and SonicWall will issue no further security updates for the class.
Alexander Capraro and Tristan Luikey assessed with medium confidence that intrusions from February to March 2026 were the first known in-the-wild exploitation of CVE-2024-12802. In one instance, attackers reached a file server and loaded pre-ransomware staging tools thirty minutes after gaining VPN access. SonicWall gave CVE-2024-12802 a CVSS score of 6.5 and Medium severity, but CISA’s Authorized Data Publisher rated it 9.1 and Critical. The CVE-2024-12802 bypass produces no failed-authentication alerts and is recorded in logs as a successful MFA event because the system issued the one-time password challenge even though the user supplied no factor.
ReliaQuest flagged event IDs 238 and 1080 as consistent indicators and pointed to sess=”CLI” in VPN authentication logs as a sign of scripted or automated authentication. ReliaQuest recommends treating sess=”CLI” as a high-priority alert condition for VPN authentication log monitoring, along with event IDs 238 and 1080. SonicWall issued an automation script for SNWLID-2025-0001 to perform the six remediation steps using the SonicOS API or SSH.
Join the discussion