SonicWall has released security updates addressing a high severity vulnerability in SonicOS that could allow attackers to bypass SAML authentication and its associated multifactor authentication requirements. Tracked as CVE-2026-19868, the flaw affects the SSL VPN component of the operating system used by SonicWall firewalls. The company disclosed the issue alongside six other vulnerabilities in an advisory published on November 6, 2026. Its security team investigated a report indicating potential exploitation, raising concerns for organizations relying on affected appliances to secure remote connections.
The vulnerability does not allow anyone to enter without credentials. Instead, an attacker must possess valid credentials for an alternative authentication method. Those credentials could then be used to bypass SAML authentication controls, potentially avoiding multifactor authentication enforced through SAML. According to SonicWall, exposure exists only when SAML login is enabled for the SSL VPN. The flaw received a CVSS severity score of 7.1 and was reported by Ryan Harris of The Electronic Office, distinguishing it from an unrestricted authentication bypass affecting every configuration.
Affected products include Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or earlier are also vulnerable. SonicWall addressed the issue in SonicOS versions 7.3.4-7013 and 8.2.3-8015, respectively. The company said no workarounds are available and strongly urged customers to upgrade promptly. For administrators, the immediate priority is therefore identifying affected firewall models, checking their installed software versions, and applying the appropriate fixed release rather than relying on an unverified temporary configuration change.
The United States Cybersecurity and Infrastructure Security Agency added the vulnerability to its Known Exploited Vulnerabilities catalog on November 6. Under Binding Operational Directive 26-04, federal agencies must address it by November 20. However, public information about exploitation remains limited. Neither SonicWall nor CISA disclosed details about the suspected attacks, their targets, or their impact. It also remains unclear whether attackers exploited the weakness before a patch became available. That distinction matters because the available reporting does not establish that this was a zero-day.
The remaining six vulnerabilities broaden the advisory’s significance, although SonicWall did not identify them as exploited. Two management interface flaws, each rated 8.8, could permit unauthorized actions under certain circumstances without authentication. Three pre-authentication buffer overflows affect the SSL VPN service and TACACS+ authentication client, potentially causing application denial of service. A weak password hashing issue affects virtual appliances but requires highly privileged local access. Together, these findings make the updates relevant beyond the SAML bypass alone, while keeping each vulnerability’s prerequisites and consequences distinct.
Read the original article: