SonicWall has disclosed an SSL-VPN authentication enforcement flaw that could let attackers bypass SAML authentication and associated multi-factor authentication controls.
Tracked as CVE-2026-19868, the issue carries a CVSS score of 7.1. Advisory SNWLID-2026-0014, published November 6, 2026, states that SonicWall PSIRT investigated a report indicating potential exploitation.
That wording signals suspected malicious activity, rather than confirming a widespread campaign or identifying the attackers behind it.
Hackers Exploit SonicWall SSL-VPN Vulnerability
The flaw affects SonicOS SSLVPN deployments only when SAML is enabled for VPN logins. Exploitation requires valid credentials for an alternate authentication method, allowing an attacker to circumvent SAML controls and potentially SAML-enforced MFA.
Classified as CWE-308, or use of single-factor authentication, the defect differs from the previously reported SSL-VPN session hijacking associated with CVE-2024-53704, which permitted authentication bypass without credentials.
The new advisory does not describe credential theft or disclose an exploit payload. Its CVSS vector, CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N, describes network-based exploitation with high attack complexity, low privileges, and no user interaction.
The assessed impact includes high confidentiality loss and limited integrity impact, without an availability impact. Crucially, the issue concerns enforcement across authentication methods, not a demonstrated cryptographic defeat of SAML itself.
An organization therefore cannot assume that enabling MFA through its identity provider necessarily protects every authentication path exposed by affected firmware.
The advisory addresses six additional defects. CVE-2026-107155 involves a permissive cross-domain security policy, while CVE-2026-107154 concerns session validation relying on IP addresses; both affect the management interface and score 8.8.
CVE-2026-82308 is a pre-authentication heap-based buffer overflow in SSL-VPN, rated 7.5, with application-level denial-of-service potential. Earlier pre-authentication heap corruption research concerned separate SMA100 appliances and must not be conflated with this SonicOS disclosure.
The supplied advisory does not attribute remote code execution to this new overflow. Two TACACS+ authentication-client flaws, CVE-2026-77708 and CVE-2026-77709, involve pre-authentication stack-based and heap-based buffer overflows respectively.
Each scores 5.9 and may cause application-level denial of service under specific conditions. Separately, CVE-2026-19703 concerns weak password hashing on virtual appliances, potentially exposing a restricted platform credential to an attacker with existing local access.
These findings are distinct from earlier SSLVPN null-pointer dereference crashes tracked as CVE-2025-32818. Affected platforms include Gen7 hardware firewalls and NSv appliances running SonicOS 7.3.3-7015 or earlier, alongside Gen8 hardware and NSv systems running 8.2.2-8015 or earlier.
SonicWall lists 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8, as fixed releases. No workaround is provided.
Administrators should prioritize affected SAML-enabled SSLVPN deployments and install the appropriate corrected firmware rather than treating existing identity-provider MFA as sufficient protection.
Join 16,000+ SOC teams using ANY.RUN to streamline threat investigations and reduce manual effort. Explore for your team
