SonicWall has patched seven vulnerabilities in its SonicOS firewall platform, including a high-severity SSL-VPN authentication flaw that can let attackers bypass SAML controls and, potentially, SAML-enforced multi-factor authentication. SonicWall’s PSIRT said it investigated a report indicating potential exploitation of CVE-2026-19868, which CISA added to its Known Exploited Vulnerabilities catalog on Nov. 6.
The flaw affects the SonicOS SSL-VPN service when SAML is enabled for VPN logins. An attacker must possess valid credentials for an alternate authentication method, but successful exploitation can circumvent the SAML authentication path. SonicWall rates the issue 7.1 High under CVSS 3.1, with a vector indicating network reachability but high attack complexity and limited privileges. The vendor advisory does not attribute the activity to a named threat actor or provide evidence of a public proof of concept.
The broader advisory, SNWLID-2026-0014, covers Gen 7 and Gen 8 physical and virtual firewalls. The most severe issue is CVE-2026-107155, a permissive cross-domain policy vulnerability in the management interface, and CVE-2026-107154, a session-validation flaw; both carry CVSS scores of 8.8 and could allow remote unauthenticated unauthorized operations under specific conditions. SonicWall also disclosed a pre-authentication heap overflow in SSL-VPN, CVE-2026-82308, rated 7.5, two pre-authentication TACACS+ buffer overflows—CVE-2026-77708 and CVE-2026-77709—each rated 5.9, and CVE-2026-19703, a weak password-hashing issue in virtual appliances rated 5.2.
Gen 7 firewalls and NSv virtual appliances running SonicOS 7.3.3-7015 or earlier are affected and should be upgraded to 7.3.4-7013 or later. Gen 8 hardware and NSv appliances running 8.2.2-8015 or earlier should be upgraded to 8.2.3-8015 or later. SonicWall’s security advisory identifies the affected product families, including TZ, NSa, NSsp and NSv deployments.
Defenders should prioritize internet-facing SonicOS management and SSL-VPN services, apply the fixed firmware releases, and review authentication and VPN logs for suspicious access—particularly on systems using SAML-based VPN authentication. Organizations should also verify that alternate authentication methods cannot provide an unintended route around their identity provider’s MFA controls. SonicWall has reported potential exploitation only for CVE-2026-19868 so far; the vendor has not reported exploitation of the other six vulnerabilities.
