SonicWall has shipped fixes for a SonicOS vulnerability that lets attackers slip past SAML logins on its firewalls' SSL VPN, including SAML-enforced multifactor authentication. The company warned that the bug may already have been used in attacks.
Tracked as CVE-2026-19868, the flaw can be abused by someone who holds valid credentials for a different authentication method. SonicWall said only SSL VPN services configured for SAML-based login are exposed. The bug carries a CVSS score of 7.1, in the high-severity range.
SonicWall said its product security team investigated a report pointing to potential exploitation, but it has not described the suspected attacks. It is also unclear whether attackers used the flaw before a patch existed.
The U.S. Cybersecurity and Infrastructure Security Agency added the bug to its Known Exploited Vulnerabilities catalog on November 6, the same day SonicWall published its advisory. Federal civilian executive branch agencies have until November 20 to secure affected systems.
Vulnerable hardware includes Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 or earlier, along with Gen8 TZ, NSa and NSv models on 8.2.2-8015 or earlier. Versions 7.3.4-7013 and 8.2.3-8015 close the hole, and SonicWall says no workarounds exist, urging customers to upgrade quickly.
Ryan Harris of The Electronic Office found and reported the vulnerability.
Six other flaws fixed
The same advisory covers six more SonicOS bugs, none flagged as exploited. Two, each scored 8.8, sit in the management interface: one involves a permissive cross-domain policy and the other a session validation weakness, and under certain conditions either could let a remote attacker take unauthorized actions without signing in.
Three others are buffer overflows reachable before authentication in the SSL VPN service and the TACACS+ authentication client, which could be used to knock services offline. The final issue is weak password hashing on virtual appliances; abusing it requires an attacker to already hold elevated local privileges, and it could expose a platform credential that controls some settings.
SonicWall products are frequent targets. CISA's catalog already lists 20 SonicWall flaws but has not yet included CVE-2026-102255, a maximum-severity bug in SMA1000 remote access appliances that drew exploitation attempts in October. Attackers chained two SMA1000 zero-days in September to run code remotely, and exploited two other zero-days in July to plant malware.
