SonicWall Patches SonicOS Flaw That Can Bypass SAML and MFA
Summary
CVE-2026-19868 can let users with valid alternate-method credentials bypass SAML and enforced MFA on affected SonicOS SSL VPNs. SonicWall investigated a report of potential exploitation; CISA added the flaw to its KEV catalog.
Key points
- CVE-2026-19868 affects SonicOS SSL VPN when SAML-based login is enabled; exploitation requires valid credentials for an alternate authentication method.
- SonicWall investigated a report indicating potential exploitation, but the vendor and CISA shared no details about suspected attacks.
- Affected devices include specified Gen7 and Gen8 firewalls running SonicOS 7.3.3-7015 or older, or 8.2.2-8015 or older.
- SonicOS 7.3.4-7013 and 8.2.3-8015 fix the flaw; SonicWall says there are no workarounds and urges customers to upgrade.
- CISA added the vulnerability to its KEV catalog; federal agencies must address it by November 20.
- The advisory covers six other flaws, including management-interface issues, pre-authentication buffer overflows, and weak password hashing.
Article Details
- Vulnerability Types
- SAML authentication bypass
- Authentication enforcement vulnerability
- Severity
- High (CVSS 7.1)
- Affected Versions
- SonicOS 7.3.3-7015 or older on Gen7 TZ, NSa, NSsp, and NSv firewalls
- SonicOS 8.2.2-8015 or older on Gen8 TZ, NSa, and NSv firewalls
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available