SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins

SonicWall has patched a SonicOS vulnerability that can be utilized to bypass SAML authentication, warning prospects that it could have been exploited in assaults.

Tracked as CVE-2026-19868, the flaw impacts the SSL VPN element of SonicOS, the working system that runs on SonicWall firewalls. It’s one in all seven vulnerabilities described in an advisory revealed on November 6.

“An authentication enforcement vulnerability in SonicOS SSLVPN service could permit a consumer with legitimate credentials for an alternate authentication technique to bypass SAML authentication controls. Profitable exploitation may additionally bypass SAML-enforced multi-factor authentication (MFA),” reads SonicWall’s description of CVE-2026-19868.

In response to the seller, an SSL VPN is uncovered provided that SAML-based login is enabled. CVE-2026-19868 has a CVSS rating of seven.1, which places it within the high-severity vary. The flaw was reported by Ryan Harris of The Digital Workplace.

SonicWall stated its product safety staff “has investigated a report indicating potential exploitation of this vulnerability.” 

CISA added CVE-2026-19868 to its Recognized Exploited Vulnerabilities (KEV) catalog on the identical day. Beneath Binding Operational Directive 26-04, federal companies should handle it by November 20. 

Neither the seller nor CISA has shared any particulars concerning the suspected assaults. It’s additionally unclear whether or not the flaw was exploited as a zero-day, earlier than a patch grew to become out there.

Impacted gadgets embody Gen7 TZ, NSa, NSsp and NSv firewalls with SonicOS 7.3.3-7015 or older. Gen8 TZ, NSa and NSv firewalls with SonicOS 8.2.2-8015 or older are additionally affected.

SonicOS variations 7.3.4-7013 and eight.2.3-8015 resolve the problem, and there aren’t any workarounds. “Prospects are strongly urged to improve to the newest launch as quickly as attainable to mitigate the related dangers,” SonicWall stated.

SonicWall’s advisory doesn’t mark any of the opposite six flaws as exploited. Two of them, every with a CVSS rating of 8.8, have an effect on the SonicOS administration interface. One is a permissive cross-domain coverage difficulty and the opposite is a session validation bug.

Beneath sure circumstances, a distant attacker might abuse both one with out logging in to take unauthorized actions. 

Three of the remaining flaws are pre-authentication buffer overflows within the SSL VPN service and the TACACS+ authentication shopper. Attackers might use them to launch DoS assaults on the utility degree.

The final one is a weak password hashing difficulty in digital home equipment. An attacker who already has high-privileged native entry might exploit it to acquire a platform credential, which supplies entry to among the platform’s settings.

Menace actors usually exploit SonicWall product vulnerabilities. CISA’s KEV catalog at present consists of 20 safety holes, however the company has but so as to add CVE-2026-102255, which hackers began concentrating on final month, simply days after its disclosure.

Associated: Cisco, WatchGuard Launch Patches; SonicWall Gained’t Repair GMS Flaws

Associated: SonicWall Warns of Two SMA1000 Zero-Days Exploited in Assaults

Associated: SonicWall and Splunk Patch Vital Vulnerabilities