SonicWall has warned customers to patch a SonicOS SSLVPN vulnerability that could let attackers bypass SAML authentication and its multi-factor authentication checks.
Tracked as CVE-2026-19868, the flaw carries a CVSS score of 7.1. The company has investigated a report indicating potential exploitation and strongly urges customers to upgrade promptly.
The issue affects SSLVPN only when SAML is enabled for logins. An attacker must have valid credentials for an alternate authentication method, making this different from a login bypass that requires no account. Under affected conditions, those credentials may allow access without passing the SAML controls intended to protect the connection.
SAML lets organizations use a central identity provider to handle user sign-ins. Here, the weakness concerns authentication enforcement through another login method, rather than a stated flaw in SAML itself.
Successful exploitation may also skip MFA enforced through SAML, leaving a gap between the security policy administrators expect and the checks actually applied.
Ryan Harris of The Electronic Office reported the vulnerability. SonicWall includes it among seven issues in its latest advisory. Although the exploitation warning raises urgency, the supplied details do not identify attackers, victims, attack dates, or the scale of activity. Describing a confirmed widespread campaign would therefore go beyond the available evidence.
Earlier SonicWall SSLVPN authentication bypass coverage shows why remote access flaws deserve attention. However, that reporting concerns CVE-2024-53704, a separate vulnerability.
Its session-hijacking behavior should not be treated as evidence of how CVE-2026-19868 works or what attackers have done with this newly disclosed issue.
SonicOS SSLVPN Vulnerability Exploited
The SonicWall security advisory, published November 6, also lists CVE-2026-107155 and CVE-2026-107154. Both score 8.8 and affect the management interface. They involve a permissive cross-domain policy and session validation, respectively, and could permit unauthorized operations under specific conditions. Their vectors include required user interaction.
CVE-2026-82308 is a pre-authentication heap buffer overflow in SSLVPN, rated 7.5. CVE-2026-77708 and CVE-2026-77709 affect the TACACS+ authentication client, and each scores 5.9. These flaws could cause application-level denial of service. CVE-2026-19703, rated 5.2, could expose a limited platform credential on virtual appliances to an attacker with existing local access.
Affected releases include Gen7 hardware and NSv appliances running SonicOS 7.3.3-7015 or earlier, and Gen8 hardware and NSv appliances running 8.2.2-8015 or earlier. SonicWall lists fixes in 7.3.4-7013 and later for Gen7, and 8.2.3-8015 and later for Gen8. No workaround is listed.
Administrators should prioritize patching, confirm their appliance generation, and install the matching fixed release. Previous SonicOS vulnerability reporting covers different flaws and firmware fixes, so older patch guidance should not replace this advisory’s requirements. Review enabled authentication methods and check VPN login activity while completing the upgrade.
Give your SOC the alert context to stops incidents quickly. Integrate Threat Intel from 16K SOCs.
