SonicWall has patched a flaw in the SSL-VPN service of its SonicOS firewalls that can let someone get past SAML sign-in, and potentially the multi-factor authentication (MFA) that SAML enforces. The company says it has investigated a report of possible exploitation, and the US Cybersecurity and Infrastructure Security Agency (CISA) has listed the bug as exploited in the wild.
The vulnerability, CVE-2026-19868, affects SonicOS Gen7 releases 7.3.3-7015 and earlier and Gen8 releases 8.2.2-8015 and earlier. SonicWall says it only matters when the SSL-VPN is set up to use SAML authentication. The fixes are SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8, and SonicWall lists no workaround.
What the flaw does
An SSL-VPN lets remote staff reach an internal network through the firewall. Many organisations hand that sign-in to a central identity provider using SAML, a standard for passing a verified login from one system to another, and that provider is often where MFA prompts happen.
SonicWall’s description says “an authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).” In other words, an attacker still needs a working credential, but one for a different login method the firewall accepts; with it, they may avoid the SAML step and its second factor. CISA classifies the weakness as use of single-factor authentication.
SonicWall rates the bug 7.1 out of 10, or high severity. Ryan Harris of The Electronic Office found and reported it, according to SecurityWeek and BleepingComputer.
Exploitation and deadlines
“SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability. Customers are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks,” the company’s product security team said in its advisory, as quoted by SecurityWeek.
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November, the day SonicWall published the advisory, and announced the addition on X.
Under CISA’s Binding Operational Directive 26-04, US federal civilian agencies must apply the vendor’s mitigations by 20 November or stop using the product if they cannot. The directive does not bind other organisations, although CISA encourages everyone to prioritise flaws in the catalogue. CISA’s entry lists ransomware use as unknown and does not require forensic triage for this bug.
Neither SonicWall nor CISA has described the attacks, and SecurityWeek reports it is unclear whether the flaw was exploited before a patch was available.
Affected hardware
SecurityWeek lists the affected Gen7 devices as TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and the affected Gen8 devices as TZ, NSa and NSv firewalls running 8.2.2-8015 or older. NSv is SonicWall’s virtual firewall.
Six more fixes in the same update
The same advisory, SNWLID-2026-0014, covers six other SonicOS vulnerabilities. SonicWall has not marked any of them as exploited. The two highest-rated affect the management interface and, under specific conditions, could let an attacker who has not logged in carry out unauthorised operations.
| CVE | Component | What it can allow | Score | Exploited? |
|---|---|---|---|---|
| CVE-2026-19868 | SSL-VPN with SAML sign-in | Someone with valid credentials for another sign-in method can bypass SAML checks, possibly including SAML-enforced MFA | 7.1 | Yes, per SonicWall and CISA |
| CVE-2026-107154 | Management interface | Session validation flaw; under specific conditions, unauthenticated unauthorised operations | 8.8 | Not reported |
| CVE-2026-107155 | Management interface | Permissive cross-domain policy; under specific conditions, unauthenticated unauthorised operations | 8.8 | Not reported |
| CVE-2026-82308 | SSL-VPN service | Pre-authentication heap overflow that can cause a denial of service | 7.5 | Not reported |
| CVE-2026-77708 | TACACS+ authentication client | Pre-authentication stack overflow that can cause a denial of service | 5.9 | Not reported |
| CVE-2026-77709 | TACACS+ authentication client | Pre-authentication heap overflow that can cause a denial of service | 5.9 | Not reported |
| CVE-2026-19703 | Virtual appliances | Weak password hashing; an attacker with existing local access could recover a platform credential | 5.1 | Not reported |
The denial-of-service bugs work at the application level, according to SonicWall’s CVE descriptions: they could disrupt the SSL-VPN or TACACS+ login service rather than give an attacker control of the firewall. The password hashing flaw requires an attacker who already has high-privileged local access to a virtual appliance, and the recovered credential opens only a limited set of platform settings.
CISA’s catalogue entry also tells organisations to evaluate each affected device’s exposure to the internet, alongside applying SonicWall’s fix.
Sources
- SonicWall PSIRT advisory SNWLID-2026-0014
- CISA: CISA adds one known exploited vulnerability to catalog
- CISA Known Exploited Vulnerabilities catalog entry
- NVD record for CVE-2026-19868
- SecurityWeek report
- BleepingComputer report
Discover more from Sulat AI & Tech News
Subscribe to get the latest posts sent to your email.
