SonicWall patches SonicOS SAML bypass exploited in attacks

SonicWall patched CVE-2026-19868, a high-severity authentication enforcement flaw in the SonicOS SSL VPN service that can let a user with valid credentials for an alternate authentication method bypass SAML authentication controls and SAML-enforced multi-factor authentication. The company published the advisory on November 6 and said its product security team had investigated a report indicating potential exploitation of the vulnerability.

The flaw has a CVSS score of 7.1 and only affects SSL VPN deployments where SAML-based login is enabled, according to SonicWall. Ryan Harris of The Electronic Office reported the issue to the vendor.

SonicWall has not shared details about the suspected attacks, and SecurityWeek noted it is unclear whether the bug was exploited as a zero-day before the patch. The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6. BleepingComputer reported that the KEV addition confirms the flaw has been exploited in the wild. Under Binding Operational Directive 26-04, federal civilian executive branch agencies must address the issue by November 20, 2026.

Affected devices include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or earlier, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or earlier. SonicWall fixed the flaw in SonicOS 7.3.4-7013 and 8.2.3-8015 and said no workarounds are available. The company urged customers to "upgrade to the latest release as soon as possible to mitigate the associated risks."

The advisory also fixes six other SonicOS vulnerabilities. Two affect the management interface and have CVSS scores of 8.8. One involves permissive cross-domain policy, and the other is a session validation flaw. A remote attacker could potentially abuse either flaw without authentication to carry out unauthorized actions. The remaining three are buffer overflows that occur before authentication in the SSL VPN service and TACACS+ authentication client, possibly leading to denial-of-service conditions. In virtual appliances, the final vulnerability is weak password hashing, which a local attacker with high privileges could use to obtain a platform credential. SonicWall's advisory does not mark any of these six flaws as exploited.

SonicWall products have faced repeated attacks in recent months. SecurityWeek reported that CISA's KEV catalog currently includes 20 SonicWall vulnerabilities, but the agency has not yet added CVE-2026-102255, a critical vulnerability that attackers began targeting last month days after disclosure. BleepingComputer noted that earlier attacks targeted SMA1000 appliances, including exploitation attempts against CVE-2026-102255 in October. Defenders should check whether SAML-based SSL VPN login is enabled on SonicWall firewalls, review authentication logs for anomalies, and apply the fixed SonicOS releases.