SonicWall Patches VPN Flaw That May Bypass SAML MFA

SonicWall patched a vulnerability in the SSL VPN component of SonicOS, the operating system used by its firewalls. The flaw, tracked as CVE-2026-19868, can let an attacker with valid credentials for an alternative authentication method bypass SAML authentication controls, including multi-factor authentication enforced through SAML.

The vulnerability affects firewalls only when SAML-based login is enabled. It has a CVSS severity score of 7.1, which falls in the high-severity range. Ryan Harris of The Electronic Office reported the issue to SonicWall.

SonicWall disclosed the vulnerability on Nov. 6 in an advisory covering seven SonicOS flaws. The company’s product security team investigated a report of potential exploitation, but provided no details about the suspected attacks. It has not confirmed whether attackers used the flaw as a zero-day before a patch became available.

The Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on Nov. 6. Federal agencies must address the issue by Nov. 20 under Binding Operational Directive 26-04.

Affected products include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or earlier. Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or earlier are also affected. SonicOS 7.3.4-7013 and 8.2.3-8015 fix the vulnerability. SonicWall has not provided a workaround and advises customers to install the latest releases.

The other six vulnerabilities in the advisory have not been identified as exploited. Two have CVSS scores of 8.8 and affect the SonicOS management interface. One involves a permissive cross-domain policy, while the other affects session validation. Under certain conditions, a remote attacker could exploit either flaw without logging in to perform unauthorized actions.

Three more vulnerabilities are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client. They could allow attackers to cause application-level denial-of-service conditions.

The remaining vulnerability affects password hashing in virtual appliances. An attacker with high-privilege local access could use it to obtain a platform credential and access some platform settings.

CISA’s Known Exploited Vulnerabilities catalog included 20 SonicWall security flaws as of Nov. 6. The catalog did not include CVE-2026-102255, which attackers reportedly began targeting in October 2026, shortly after its disclosure.