Microsoft patcht een RCE-lek in Windows Paint, SonicWall dicht een MFA-bypass, een Franse bank verliest 133 miljoen dollar en het NCSC krijgt een eigen scanplatform.

SonicWall Issues Urgent Patch for Exploited SSL-VPN Authentication Flaw

SonicWall's high-severity SAML bypass flaw threatens VPN security. This guide helps vCISOs patch without disrupting access, ensuring compliance and risk mitigation.

SonicWall and Splunk have rolled out patches for multiple critical- and high-severity vulnerabilities in their products.

SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks. Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1. The company has investigated a report indicating potential exploitation and strongly urges customers to upgrade promptly. The issue affects SSLVPN only when SAML is enabled for logins. An attacker must have valid credentials for an alternate authentication method, making this different from a login bypass that requires no account. Under affected conditions, those credentials may allow access without passing the SAML controls intended to protect the connection. SAML lets organizations use a central identity provider to handle user sign-ins. Here, the weakness concerns authentication enforcement through another login method, rather than a stated flaw in SAML itself. Successful exploitation may also skip MFA enforced through SAML, leaving a gap between the security policy administrators expect and the checks actually applied. Ryan Harris of The Electronic Office reported the vulnerability. SonicWall includes it among seven issues in its latest advisory. Although the exploitation warning raises urgency, the supplied details do not identify attackers, victims, attack dates, or the scale of activity. Describing a confirmed widespread campaign would therefore go beyond the available evidence. Earlier SonicWall SSLVPN authentication bypass coverage shows why remote access flaws deserve attention. However, that reporting concerns CVE-2024-53704, a separate vulnerability. Its session-hijacking behavior should not be treated as evidence of how CVE-2026-19868 works or what attackers have done with this newly disclosed issue. SonicOS SSLVPN Vulnerability Exploited The SonicWall security advisory , published November 6, also lists CVE-2026-107155 and CVE-2026-107154. Both score 8.8 and affect the management interface. They involve a permissive cross-domain policy and session validation, respectively, and could permit unauthorized operations under specific conditions. Their vectors include required user interaction. CVE-2026-82308 is a pre-authentication heap buffer overflow in SSLVPN, rated 7.5. CVE-2026-77708 and CVE-2026-77709 affect the TACACS+ authentication client, and each scores 5.9. These flaws could cause application-level denial of service. CVE-2026-19703, rated 5.2, could expose a limited platform credential on virtual appliances to an attacker with existing local access. Affected releases include Gen7 hardware and NSv appliances running SonicOS 7.3.3-7015 or earlier, and Gen8 hardware and NSv appliances running 8.2.2-8015 or earlier. SonicWall lists fixes in 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. No workaround is listed. Administrators should prioritize patching, confirm their appliance generation, and install the matching fixed release. Previous SonicOS vulnerability reporting covers different flaws and firmware fixes, so older patch guidance should not replace this advisory’s requirements. Review enabled authentication methods and check VPN login activity while completing the upgrade. Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs . The post SonicWall Warns of Potential In-the-Wild Exploitation of SSLVPN Flaw That Bypasses MFA appeared first on Cyber Security News .

SonicWall warns two flaws in end-of-life GMS 9.5.2 and earlier will remain unpatched, allowing file reads or SQL injection under specific conditions.

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins. According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls and, with them, any MFA enforced through SAML. In practice, that means a VPN login that should have gone through the organization’s identity provider (e.g., Okta or Microsoft Entra ID) and its MFA check can succeed with a password alone.

SonicWall has fixed an exploited SonicOS SSL-VPN vulnerability (CVE-2026-19868) that may allow attackers with valid credentials to bypass SAML-enforced multi-factor authentication. With no workarounds listed, the company has urged admins to patch quickly. About CVE-2026-19868 CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN service, and is exploitable only if SAML is enabled for SSL-VPN logins. According to SonicWall, a user with valid credentials for an alternate authentication method may be able to bypass …

TL;DR Threat actors are exploiting a SonicWall SonicOS SSLVPN login bug in the wild to skip multi-factor checks. Tracked as CVE-2026-19868, the flaw led CISA to issue an urgent federal patch order alongside six other SonicOS fixes. Network admins must update Gen7 and Gen8 firewalls right away because no workarounds exist. Why It Matters SonicWall firewalls and SonicWall SonicOS SSLVPN gateways guard edge networks for hundreds of thousands of firms worldwide.

In other news: US arrests an AI deepfake gang; SonicWall patches a zero-day; SSHhole is now being exploited in the wild.

24 failles exploitées, 2 critiques, 124 avis.