EN PT-BR
← Voltar ao feed
high

SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 exploited in the wild; CISA adds it to KEV alongside six other fixes

1 fonte(s) · 1 atualização(ões) · publicado 06/11/2026 19:50 · coletado há 1 hora

SonicWall has confirmed in-the-wild exploitation of CVE-2026-19868, an authentication weakness in the SonicOS SSLVPN service that allows a user holding valid credentials for an alternate authentication method to bypass SAML checks and the MFA rules enforced through them. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 6 November 2026, triggering a federal remediation deadline. The vendor advisory SNWLID-2026-0014 covers seven issues in total — four High and three Medium — of which only CVE-2026-19868 is reported as exploited; no public exploit code is reported for the others. Exposure is limited to deployments where SAML is enabled for SSLVPN logins, which tempers the otherwise edge-facing risk, but the affected appliances sit directly on the network perimeter. SonicWall states that no workarounds exist and urges immediate upgrade of Gen7 and Gen8 firewalls and NSv virtual appliances.

Entenda a falha

A vulnerabilidade

SonicWall advisory SNWLID-2026-0014 fixes seven SonicOS flaws. The two most severe (CVSS 8.8) are in the web management portal: CVE-2026-107154 (reliance on IP address for authentication) and CVE-2026-107155 (overly permissive cross-domain policy). They let remote attackers perform unauthorised actions when specific settings are enabled. CVE-2026-19868 (CVSS 7.1, CWE-308) is the only one exploited in the wild. In the SSLVPN service, a user with valid credentials for an alternate authentication method can skip SAML and its MFA rules, but only when SAML is enabled for SSLVPN logins. The rest are CVE-2026-82308 (7.5, pre-auth heap overflow in SSL-VPN causing denial of service), CVE-2026-77708 and CVE-2026-77709 (5.9, pre-auth stack and heap overflows in the TACACS+ client) and CVE-2026-19703 (5.2, weak password hashing on virtual appliances). Affected: Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015, including NSv. Fixed in 7.3.4-7013 and 8.2.3-8015.

Como funciona

For CVE-2026-19868, a user connects to the SonicOS SSLVPN login on a firewall where SAML is enabled for SSLVPN logins. Normally SAML authentication, and the MFA rules enforced through it, must be completed before access is granted. If the user holds valid credentials for an alternate authentication method, the service lets them proceed without completing the SAML step, so the multi-factor requirement is never applied. The articles do not describe the internal code path in more detail.

Por que é vulnerável

CVE-2026-19868 is classified as CWE-308, use of single-factor authentication. The SSLVPN service accepts a login through an alternate authentication method without enforcing the SAML and MFA checks that the configuration is supposed to require. The articles do not explain why it went unnoticed or what exactly the patch changes in the code. The other flaws are described only by class: reliance on IP address for authentication, a permissive cross-domain policy, buffer overflows and weak password hashing.

Onde está

The flaw is in the SonicOS SSLVPN service (SAML login handling), documented in advisory SNWLID-2026-0014; no article names a file, function or commit.

Como foi descoberta

The articles do not say who found CVE-2026-19868 or how. SonicWall's advisory SNWLID-2026-0014 confirms that it is being exploited in the wild, and CISA added it to the Known Exploited Vulnerabilities catalog on 6 November 2026. For the other six issues, the sources report no active attacks and no public exploit code.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

No article describes a published proof of concept. What the sources confirm is real-world exploitation of CVE-2026-19868 by threat actors to skip MFA on SSLVPN logins, with no public exploit code reported. Because it is already used in attacks and sits on the network perimeter, patching is urgent, especially where SAML is enabled for SSLVPN.

Explicação gerada por IA a partir da matéria e dos artigos, em 06/11/2026 20:15.

Detalhes técnicos

  • CVE-2026-19868 (CVSS 7.1, CWE-308, use of single-factor authentication) in the SSLVPN service: a user with valid credentials for an alternate method can skip SAML authentication and the associated multi-factor requirement. Per the advisory, it only affects the SonicOS SSLVPN interface when SAML is enabled for SSLVPN logins.
  • CVE-2026-107154 (CVSS 8.8, CWE-291, reliance on IP address for authentication) and CVE-2026-107155 (CVSS 8.8, CWE-942, overly permissive cross-domain policy) in the web management portal allow remote attackers to perform unauthorised actions when specific settings are enabled.
  • CVE-2026-82308 (CVSS 7.5): pre-authentication heap overflow in SSL-VPN leading to denial of service.
  • CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9): pre-authentication stack and heap overflows in the TACACS+ client.
  • CVE-2026-19703 (CVSS 5.2): weak password hashing on virtual appliances allowing a local user to recover a limited credential.
  • Affected: Gen7 platforms running SonicOS 7.3.3-7015 and earlier; Gen8 platforms running 8.2.2-8015 and earlier, including NSv virtual firewalls.

Remediação

  • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later and Gen8 firewalls to 8.2.3-8015 or later; no mitigations or workarounds are available.
  • Where SAML is used for SSLVPN, review authentication logs for sessions that completed without the expected MFA step, and rotate credentials of accounts configured with alternate authentication methods.
  • Federal civilian agencies must remediate CVE-2026-19868 within the CISA KEV deadline.

Linha do tempo

  1. securityonline.info ↗ · pub. 06/11/2026 19:50 · coletado 06/11 20:00 primeiro registro

    SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 exploited in the wild; CISA adds it to KEV alongside six other fixes

    ler a análise desta fonte

    SonicWall has confirmed in-the-wild exploitation of CVE-2026-19868, an authentication weakness in the SonicOS SSLVPN service that allows a user holding valid credentials for an alternate authentication method to bypass SAML checks and the MFA rules enforced through them. CISA added the flaw to its Known Exploited Vulnerabilities catalog on 6 November 2026, triggering a federal remediation deadline. The vendor advisory SNWLID-2026-0014 covers seven issues in total — four High and three Medium — of which only CVE-2026-19868 is reported as exploited; no public exploit code is reported for the others. Exposure is limited to deployments where SAML is enabled for SSLVPN logins, which tempers the otherwise edge-facing risk, but the affected appliances sit directly on the network perimeter. SonicWall states that no workarounds exist and urges immediate upgrade of Gen7 and Gen8 firewalls and NSv virtual appliances.

    Technical Details

    • CVE-2026-19868 (CVSS 7.1, CWE-308, use of single-factor authentication) in the SSLVPN service: a user with valid credentials for an alternate method can skip SAML authentication and the associated multi-factor requirement. Per the advisory, it only affects the SonicOS SSLVPN interface when SAML is enabled for SSLVPN logins.
    • CVE-2026-107154 (CVSS 8.8, CWE-291, reliance on IP address for authentication) and CVE-2026-107155 (CVSS 8.8, CWE-942, overly permissive cross-domain policy) in the web management portal allow remote attackers to perform unauthorised actions when specific settings are enabled.
    • CVE-2026-82308 (CVSS 7.5): pre-authentication heap overflow in SSL-VPN leading to denial of service.
    • CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9): pre-authentication stack and heap overflows in the TACACS+ client.
    • CVE-2026-19703 (CVSS 5.2): weak password hashing on virtual appliances allowing a local user to recover a limited credential.
    • Affected: Gen7 platforms running SonicOS 7.3.3-7015 and earlier; Gen8 platforms running 8.2.2-8015 and earlier, including NSv virtual firewalls.

    Remediation

    • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later and Gen8 firewalls to 8.2.3-8015 or later; no mitigations or workarounds are available.
    • Where SAML is used for SSLVPN, review authentication logs for sessions that completed without the expected MFA step, and rotate credentials of accounts configured with alternate authentication methods.
    • Federal civilian agencies must remediate CVE-2026-19868 within the CISA KEV deadline.