SonicWall has successfully patched a significant vulnerability within its SonicOS that could potentially permit attackers to bypass SAML authentication. This security issue, identified as CVE-2026-19868, poses a threat to the SSL VPN component integral to SonicWall’s firewall systems. The flaw was highlighted in an advisory released on November 6.
Details of the Security Flaw
The vulnerability in question affects the SonicOS SSLVPN service, allowing users with credentials for different authentication methods to bypass SAML authentication controls. This breach could potentially extend to bypassing SAML-enforced multi-factor authentication (MFA). The flaw, which bears a CVSS score of 7.1, falls within the high-severity category and has been reported by Ryan Harris from The Electronic Office.
According to SonicWall, the SSL VPN is vulnerable only when SAML-based logins are activated. The company’s security team has investigated reports suggesting this flaw may have been exploited in real-world scenarios.
Official Responses and Mitigation
The Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its Known Exploited Vulnerabilities (KEV) catalog, necessitating action from federal agencies by November 20. However, specific details about potential attacks or whether this vulnerability was exploited as a zero-day remain undisclosed.
Devices affected include Gen7 TZ, NSa, NSsp, and NSv firewalls with older SonicOS versions, specifically 7.3.3-7015 or earlier. Similarly, Gen8 models with SonicOS 8.2.2-8015 or earlier are also impacted. To mitigate risks, SonicWall advises users to upgrade to SonicOS versions 7.3.4-7013 and 8.2.3-8015 immediately, as no workarounds exist.
Additional Vulnerabilities and Recommendations
While the advisory notes six additional vulnerabilities, none are marked as exploited. Two of these, each with a CVSS score of 8.8, involve issues with the SonicOS management interface, including a permissive cross-domain policy and a session validation flaw. Under certain conditions, these could allow unauthorized access without logging in.
Other vulnerabilities include pre-authentication buffer overflows and a weak password hashing issue, which could be exploited for unauthorized access or denial-of-service attacks. SonicWall emphasizes the importance of regular updates to protect against such threats.
Historically, SonicWall products have been targeted by threat actors, with multiple security holes listed in CISA’s KEV catalog. However, CVE-2026-102255, which surfaced last month, is not yet included.
For continued protection, users are urged to heed SonicWall’s recommendations and ensure their systems are up-to-date, reflecting the latest security patches.
