SonicWall has issued an urgent advisory for its customers to address a vulnerability in SonicOS SSLVPN that may allow attackers to bypass SAML authentication and multi-factor authentication (MFA) checks. This flaw, identified as CVE-2026-19868, has been assigned a CVSS score of 7.1, indicating its potential severity.
Understanding the Vulnerability
The flaw specifically affects SSLVPN configurations where SAML is enabled for user logins. Attackers must possess valid credentials from an alternative authentication method, differentiating this issue from a direct login bypass that requires no user account. Under these conditions, attackers could potentially access the system without triggering SAML’s protective measures.
SAML, or Security Assertion Markup Language, is utilized by organizations for centralized user authentication. The identified weakness arises from the improper enforcement of authentication through additional login methods, rather than from SAML itself.
Implications of the Exploitation
If successfully exploited, the vulnerability could allow attackers to circumvent SAML-enforced MFA, creating a significant security gap. This exposure deviates from the protection administrators expect and what is effectively implemented.
The vulnerability was reported by Ryan Harris from The Electronic Office and is part of a broader advisory that includes seven issues. Despite the urgency of the warning, specific details regarding attackers, potential victims, dates, or the scale of exploitation remain undisclosed.
Additional Vulnerabilities and Recommendations
The advisory also highlights other vulnerabilities such as CVE-2026-107155 and CVE-2026-107154, both scoring 8.8, impacting the management interface. These involve permissive cross-domain policies and session validation, potentially enabling unauthorized operations. Another flaw, CVE-2026-82308, a pre-authentication heap buffer overflow, carries a score of 7.5.
Affected SonicWall releases include Gen7 hardware and NSv appliances running versions 7.3.3-7015 or earlier, and Gen8 hardware with versions 8.2.2-8015 or earlier. SonicWall provides fixes in 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. It is crucial for administrators to patch these vulnerabilities, confirm appliance versions, and ensure the installation of the appropriate updates.
Maintaining robust security requires reviewing enabled authentication methods and monitoring VPN login activity during the upgrade process. SonicWall’s previous advisories may cover different vulnerabilities and solutions, but the current guidance should be followed to safeguard systems.
