cyber.hendryadrian.com
Vulnerability & Exploit · databreachtoday.com

SonicWall Patches Actively Exploited SAML and MFA Bypass Flaw

· Original article ↗

Summary

CVE-2026-19868 lets users with valid alternate-method credentials bypass SAML and SAML-enforced MFA on affected SonicWall firewalls. CISA lists it as exploited; SonicWall is investigating reports and has released fixes and a workaround.

Key points

  • CVE-2026-19868 affects SonicWall Gen7 and Gen8 devices running vulnerable SonicOS versions.
  • An attacker with valid credentials for an alternate authentication method may bypass SAML and SAML-enforced MFA on the SSL VPN.
  • CISA added the flaw to its Known Exploited Vulnerabilities catalog; SonicWall said it was investigating reports of exploitation, with no attacker attributed.
  • A Python proof-of-concept appeared on GitHub; its notes say it requires working alternate-method credentials.
  • SonicOS 7.3.4-7013 and 8.2.3-8015 and later include fixes. The article lists affected versions up to and including 7.3.3-7015 and 8.2.2-8015, respectively.
  • If firmware cannot be upgraded and SAML authentication is in use, SonicWall's workaround is to disable or delete active LDAP, RADIUS, and TACACS+ authentication servers configured on the firewall.

Article Details

Vulnerability Types
  • Authentication enforcement vulnerability allowing SAML authentication and SAML-enforced MFA bypass
Severity
CVSS v3 7.5
Affected Versions
  • SonicOS 7.3.3-7015 and earlier
  • SonicOS 8.2.2-8015 and earlier
Exploitation Status
active
Exploit Availability
public_poc
Patch Status
available
Workarounds
  • If SAML authentication is in use and firmware cannot be upgraded, disable or delete any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall.

MITRE ATT&CK

T1078 · Valid AccountsThe article says exploitation requires working credentials for an alternate authentication method.

CVE

CVE-2026-19868SonicWall · SonicOSThe vulnerability in SonicWall Gen7 and Gen8 devices, assigned CVE-2026-19868, has a CVSS v3 score of 7.5. SonicOS versions up to and including 7.3.3-7015 and before, as well as 8.2.2-8015 and before, are vulnerable.

People

Ryan HarrisSonicWall credited him with discovering CVE-2026-19868.

Vendors

SonicWallAttackers are actively exploiting a flaw in the operating system that powers SonicWall firewalls to bypass multifactor authentication and gain access to the devices.

Products

NSaAffected systems running the vulnerable SonicWall SonicOS include the TZ hardware firewall, NSa network security appliances and NSv, which is a software-based next-generation firewall.NSvAffected systems running the vulnerable SonicWall SonicOS include the TZ hardware firewall, NSa network security appliances and NSv, which is a software-based next-generation firewall.SonicOS"An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation mayTZAffected systems running the vulnerable SonicWall SonicOS include the TZ hardware firewall, NSa network security appliances and NSv, which is a software-based next-generation firewall.

Related Articles