SonicWall has patched a SonicOS vulnerability that can be used to bypass SAML authentication, warning customers that it may have been exploited in attacks.
Tracked as CVE-2026-19868The flaw affects the SSL VPN component of SonicOS, the operating system that runs on SonicWall firewalls. It is one of seven vulnerabilities described in a advisory published on November 6.
“An authentication enforcement vulnerability in the SonicOS SSLVPN service could allow a user with valid credentials for another authentication method to bypass SAML authentication controls. Successful exploitation could also bypass SAML-enhanced multi-factor authentication (MFA),” reads SonicWall’s description of CVE-2026-19868.
Depending on the provider, an SSL VPN is only exposed if the SAML connection is enabled. CVE-2026-19868 has a CVSS score of 7.1, placing it in the high severity range. The flaw was reported by Ryan Harris of The Electronic Office.
SonicWall said its product security team “investigated a report indicating potential exploitation of this vulnerability.”
CISA added CVE-2026-19868 to its catalog of known exploited vulnerabilities (KEV) on the same day. Under Binding Operational Directive 26-04, federal agencies must respond by November 20.
Neither the vendor nor CISA have shared details about the alleged attacks. It is also unclear whether the flaw was exploited as a zero-day, before a patch was available.
Affected devices include Gen7 TZ, NSa, NSsp, and NSv firewalls with SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa, and NSv firewalls with SonicOS 8.2.2-8015 or earlier are also affected.
SonicOS versions 7.3.4-7013 and 8.2.3-8015 fix the issue and there are no workarounds. “Customers are strongly encouraged to upgrade to the latest version as soon as possible to mitigate associated risks,” SonicWall said.
SonicWall’s advisory does not mark any of the other six vulnerabilities as exploited. Two of them, each with a CVSS score of 8.8, affect the SonicOS management interface. One is a cross-domain permissive policy issue and the other is a session validation bug.
In certain circumstances, a remote attacker could abuse either without connecting to take unauthorized actions.
Three of the remaining vulnerabilities are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client. Attackers could use them to launch application-level DoS attacks.
The last one is a weak password hashing issue in virtual appliances. An attacker who already has highly privileged local access could exploit this to obtain a platform identifier, which grants access to certain platform settings.
Malicious actors often exploit vulnerabilities in SonicWall products. The CISA KEV catalog currently includes 20 security vulnerabilities, but the agency has yet to add CVE-2026-102255, which hackers began targeting last month, just days after its disclosure.
Related: Cisco, WatchGuard release fixes; SonicWall will not fix GMS flaws
Related: SonicWall warns of two SMA1000 Zero-Day exploited in attacks
Related: Critical vulnerabilities in SonicWall and Splunk Patch
