SonicWall Patches Exploited SonicOS SSL-VPN SAML Authentication Bypass

Summary

SonicWall patched seven SonicOS flaws, including CVE-2026-19868, an SSL-VPN SAML authentication bypass affecting SAML-configured services. CISA added it to KEV, confirming in-the-wild exploitation; fixes cover specified Gen7 and Gen8 versions.

Key points

CVE-2026-19868 lets attackers with valid credentials for an alternate authentication method bypass SAML controls, potentially including SAML-enforced MFA.
The flaw affects SonicOS SSL-VPN services configured to use SAML; it has a CVSS score of 7.1.
SonicWall said it investigated a report of potential exploitation; CISA added the flaw to its KEV catalog, confirming exploitation in the wild.
The advisory fixes six other flaws, including two management-interface vulnerabilities and pre-authentication buffer overflows that could cause denial of service.
Affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier; fixes are in 7.3.4-7013 and 8.2.3-8015. SonicWall says no workarounds are available.
CISA ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.

Article Details

Vulnerability Types: SSL-VPN SAML authentication bypass
Management interface flaws permitting unauthorized operations
Pre-authentication buffer overflows
Weak password hashing
Severity: CVSS 7.1 for CVE-2026-19868
Affected Versions: SonicOS Gen7 7.3.3-7015 and earlier
SonicOS Gen8 8.2.2-8015 and earlier
Exploitation Status: active
Exploit Availability: unknown
Patch Status: available