EN PT-BR
← Voltar ao feed
high

SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 added to CISA KEV; patches released for seven flaws

7 fonte(s) · 5 atualização(ões) · 3 repetição(ões) · publicado 06/11/2026 19:50 · coletado há 9 horas

Matéria consolidada. Reúne 2 matérias que o Tifon tinha publicado separadamente sobre a mesma história. A IA reescreveu o relatório com o que as 7 fontes trouxeram em 09/11/2026 12:11; os links antigos trazem para cá.

Fontes: helpnetsecurity.com ↗ gbhackers.com ×2 ↗ thehackernews.com ↗ securityaffairs.com ↗ securityweek.com ↗ bleepingcomputer.com ↗ securityonline.info ↗

SonicWall published advisory SNWLID-2026-0014 on November 6, 2026, fixing seven SonicOS flaws. The most important is CVE-2026-19868, an authentication enforcement flaw (CWE-308) in the SonicOS SSLVPN service. A user holding valid credentials for an alternate login method can skip SAML checks, including SAML-enforced MFA (securityweek.com, bleepingcomputer.com). CISA added it to the Known Exploited Vulnerabilities (KEV) catalog the same day, with a federal deadline of November 20, 2026 under Binding Operational Directive 26-04 (securityweek.com). SonicWall's PSIRT says only that it investigated a report of potential exploitation. Neither SonicWall nor CISA has published details of the attacks, said who is behind them, or said whether the flaw was used as a zero-day (securityweek.com, thehackernews.com). The vendor scores it CVSS 7.1. It affects only SSLVPN with SAML enabled (a non-default setup) and needs valid credentials for another method, so urgency is high rather than critical. No workaround exists, so patching is the only fix (bleepingcomputer.com, helpnetsecurity.com).

Entenda a falha

A vulnerabilidade

CVE-2026-19868 (CVSS 7.1 per the vendor; some outlets say 7.5) is an authentication enforcement flaw (CWE-308) in the SonicOS SSLVPN service. It matters only when SAML is enabled for SSLVPN logins, a non-default setup. An attacker needs valid credentials for an alternate login method, and can then skip the SAML checks, including SAML-enforced MFA. It is not an unauthenticated bypass. Affected: Gen7 (TZ, NSa, NSsp, NSv) up to 7.3.3-7015 and Gen8 (TZ, NSa, NSv) up to 8.2.2-8015. Fixed in Gen7 7.3.4-7013 or later and Gen8 8.2.3-8015 or later; there is no workaround. CISA added it to KEV on 6 November 2026. The same advisory fixes CVE-2026-107155 and CVE-2026-107154 (8.8, management interface, unauthorized operations under specific conditions), CVE-2026-82308 (7.5, pre-auth heap overflow in SSL-VPN, DoS) and three lower-severity flaws (CVE-2026-77708, CVE-2026-77709, CVE-2026-19703).

Como funciona

A user reaches the SonicOS SSLVPN login on a firewall where SAML is enabled. Normally the login goes through the organization's identity provider (for example Okta or Microsoft Entra ID), and the SAML authentication plus any MFA enforced there must finish before access is granted. If the user holds valid credentials for another authentication method exposed by the service, that path is accepted without applying the SAML controls. The MFA step never happens and the VPN session is established, in practice with a password alone. The articles describe an enforcement gap between authentication methods, not a break of SAML itself, and do not detail the internal code path.

Por que é vulnerável

The flaw is classified as CWE-308, use of single-factor authentication. The SSLVPN service does not consistently enforce SAML across every authentication method it exposes, so an alternate method sidesteps the SAML and MFA checks the configuration is meant to require. Organizations therefore cannot assume that identity-provider MFA protects every authentication path on affected firmware. The articles do not explain why it went unnoticed or what exactly the patch changes. The other flaws are described only by class: a permissive cross-domain policy, session validation relying on IP addresses, stack and heap overflows, and weak password hashing.

Onde está

The flaw is in the SonicOS SSLVPN service (SAML login handling), covered by SonicWall advisory SNWLID-2026-0014 of 6 November 2026; no article names a file, function or commit.

Como foi descoberta

BleepingComputer, SecurityWeek and Help Net Security say Ryan Harris of the IT services provider The Electronic Office discovered and reported CVE-2026-19868. SonicWall's PSIRT says only that it investigated a report indicating potential exploitation and urges customers to upgrade. CISA added the flaw to KEV on 6 November 2026, with a federal deadline of 20 November; the KEV listing is the basis for the confirmed exploitation. Neither SonicWall nor CISA has shared attack details, indicators of compromise or the actors involved, and it is unclear whether it was exploited as a zero-day. One outlet (securityonline.info) claimed the advisory confirms abuse, but the vendor's wording is only 'potential exploitation'. No exploitation is reported for the other six flaws.

PoC existente, privada

O exploit existe, mas quem o tem não o publicou.

The KEV listing indicates CVE-2026-19868 is exploited in the wild, so working attack methods exist, but no article reports a public proof of concept or exploit code, and no attack details have been published. For the other six flaws, no exploit is reported. Because it is already exploited, needs only valid credentials for another login method and has no workaround, patching is urgent on any firewall with SAML-enabled SSLVPN. Also review SSL-VPN logins that succeeded without a matching sign-in and MFA check in the identity provider's logs.

Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 12:27.

Detalhes técnicos

  • CVE-2026-19868: the CVSS vector is network-based, high attack complexity, low privileges, no user interaction, high confidentiality impact, limited integrity impact, no availability impact (gbhackers.com). It is an inconsistent authentication enforcement flaw, not a cryptographic break of SAML (gbhackers.com).
  • Companion flaws in the same advisory:
    • CVE-2026-107155 (permissive cross-domain policy, CWE-942) and CVE-2026-107154 (session/IP check defect, CWE-291) are both rated 8.8. They affect the management interface and allow unauthorized operations under specific settings (securityonline.info, gbhackers.com).
    • CVE-2026-82308 (7.5) is a pre-authentication heap overflow in SSL-VPN that can cause denial of service.
    • CVE-2026-77708 and CVE-2026-77709 (5.9 each) are stack and heap overflows in the TACACS+ client.
    • CVE-2026-19703 (5.2) is weak password hashing on virtual appliances that requires existing local access (securityonline.info, gbhackers.com).
  • Affected builds are Gen7 SonicOS 7.3.3-7015 and older and Gen8 SonicOS 8.2.2-8015 and older (sonicwall.com, bleepingcomputer.com). Press lists Gen7 TZ, NSa, NSsp and NSv, and Gen8 TZ, NSa and NSv (securityweek.com).
  • Context: SonicWall recently detailed two unpatched flaws in end-of-life GMS systems, CVE-2026-109593 and CVE-2026-109594, and urged moving to Network Security Manager (NSM) (thehackernews.com). The SMA1000 bug CVE-2026-102255 has been targeted since October and is not yet in KEV (securityweek.com, bleepingcomputer.com).

Remediação

  • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later. The advisory table dates 7.3.4-7013 to October 20 and 7.3.4-7015 to November 5, 2026 (sonicwall.com).
  • Upgrade Gen8 firewalls to SonicOS 8.2.3-8015 or later, listed as scheduled for November 6, 2026 (sonicwall.com).
  • No workaround exists (securityweek.com, bleepingcomputer.com).
  • The NSv virtual firewall may not yet have a Gen7 7.3.4 build, so check platform availability before planning (esecurityplanet.com, cited by securityweek.com).
  • Gen6 and older firmware is end of support, so replace those devices with Gen8 (sonicwall.com).
  • Prioritize SAML-backed SSL-VPN deployments. Review logs for logins that appear to have skipped MFA, and do not treat MFA as a substitute for patching while an alternate authentication method is reachable (securityonline.info, gbhackers.com).
  • Federal civilian agencies must patch by November 20, 2026 (thehackernews.com).

Relatos divergentes

  • Exploitation status: securityonline.info initially said the advisory confirmed real-world abuse. bleepingcomputer.com and securityweek.com correct this: SonicWall only investigated a report of potential exploitation. The confirmation of exploitation rests on the CISA KEV listing. thehackernews.com says the KEV addition followed reports that the flaw "may have been" exploited, and gbhackers.com says no widespread campaign was confirmed. The KEV listing and the later corrections are the more authoritative basis.
  • CVSS score: the vendor score is 7.1 (bleepingcomputer.com, helpnetsecurity.com, cyberpress.org). thehackernews.com gives "7.1 / 7.5" without attribution, and 7.1 is the better-supported figure.
  • Affected models: securityweek.com lists Gen7 TZ, NSa, NSsp and NSv, and Gen8 TZ, NSa and NSv. securityonline.info lists TZ, NSa, NSsp and NSv without a Gen split, and gbhackers.com mentions only Gen7 hardware and NSv. The vendor advisory (sonicwall.com) covers Gen7 and Gen8 physical and virtual firewalls.
  • Management-interface flaws: bleepingcomputer.com describes the attackers as unauthenticated, while securityonline.info says remote attackers and gbhackers.com says only that unauthorized management operations are possible under specific conditions.

Linha do tempo

  1. gbhackers.com ↗ · pub. 09/11/2026 03:20 · coletado 09/11 04:00

    SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 bypasses SAML-enforced MFA; added to CISA KEV

    ler a análise desta fonte

    SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, headed by CVE-2026-19868, an SSL-VPN authentication enforcement flaw that lets a user holding valid credentials for an alternate authentication method bypass SAML controls and the MFA enforced through them. The vendor rated it CVSS 7.1 (the advisory's highest score, 8.8, belongs to other issues) and classified it as CWE-308, inconsistent authentication enforcement rather than a cryptographic break of SAML. The article states SonicWall investigated reports of potential exploitation without confirming a widespread campaign; CISA has since added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026 with a federal remediation due date of 20 November 2026 (rescana.com, dev.to). Exploitation is not credentialless: it requires usable credentials on another authentication method exposed by the SSL-VPN service, and the CVSS vector records high attack complexity, which limits the practical risk for deployments without exposed alternate login paths.

    Technical Details

    The CVSS vector describes network-based exploitation, high attack complexity, low privileges required and no user interaction, with high confidentiality impact, limited integrity impact and no availability impact. Only SSL-VPN services configured for SAML authentication are affected. The same advisory lists CVE-2026-107155 (permissive cross-domain policy, 8.8) and CVE-2026-107154 (session-validation defect, 8.8), either of which could enable unauthorized management operations under specific conditions; CVE-2026-82308, a pre-authentication SSL-VPN heap overflow (7.5) causing application-level denial of service; CVE-2026-77708 and CVE-2026-77709, TACACS+ client stack and heap buffer overflows (5.9 each); and CVE-2026-19703 (5.2), weak password hashing on virtual appliances requiring existing local access.

    Remediation

    Affected Gen7 hardware and NSv appliances run SonicOS 7.3.3-7015 or earlier; affected Gen8 systems run 8.2.2-8015 or earlier. Fixed releases are Gen7 7.3.4-7013 and later and Gen8 8.2.3-8015 and later. No workaround is provided. Administrators should prioritise SAML-backed SSL-VPN deployments, verify appliance generation and firmware, and treat MFA as no substitute for patching where an alternate authentication method remains reachable.

  2. thehackernews.com ↗ · pub. 09/11/2026 03:05 · coletado 09/11 04:00

    SonicWall SonicOS SSL-VPN SAML/MFA bypass CVE-2026-19868 exploited, added to CISA KEV

    The article adds that SonicWall, days before the KEV addition, detailed two unpatched flaws in end-of-life Global Management System (GMS) systems, CVE-2026-109593 and CVE-2026-109594, and urged customers to upgrade to Network Security Manager (NSM) (thehackernews.com). It also frames the KEV addition as following reports that the flaw may have been exploited, a more cautious wording than the listing itself.

    ler a análise desta fonte

    The article adds that SonicWall, days before the KEV addition, detailed two unpatched flaws in end-of-life Global Management System (GMS) systems, CVE-2026-109593 and CVE-2026-109594, and urged customers to upgrade to Network Security Manager (NSM) (thehackernews.com). It also frames the KEV addition as following reports that the flaw may have been exploited, a more cautious wording than the listing itself.

    SonicWall has patched CVE-2026-19868, a high-severity authentication enforcement flaw in the SonicOS SSL-VPN service, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog after reports that it may have been used in real-world attacks (thehackernews.com). The flaw lets a user with valid credentials for an alternate authentication method bypass SAML controls, and successful exploitation may also bypass SAML-enforced MFA (thehackernews.com). The vendor scores it 7.1 (helpnetsecurity.com), while the article gives 7.1 / 7.5 without attribution. The same advisory covers two 8.8 flaws in the management interface, CVE-2026-107155 and CVE-2026-107154, and a pre-authentication heap overflow in SSL-VPN, CVE-2026-82308, rated 7.5 (thehackernews.com). SonicWall has not described the attacks or who is behind them (thehackernews.com), and the bypass needs valid credentials plus SAML enabled on SSL-VPN, which limits the immediate risk (helpnetsecurity.com). Days earlier, SonicWall flagged two unpatched flaws in end-of-life GMS systems and urged customers to move to Network Security Manager (NSM) (thehackernews.com).

    Remediation

    • Apply the SonicWall fix for your platform; the vendor lists no workarounds (helpnetsecurity.com).
    • Federal Civilian Executive Branch agencies must patch by November 20, 2026 (thehackernews.com).
  3. securityweek.com ↗ · pub. 07/11/2026 07:16 · coletado 07/11 08:00

    SonicWall patches SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868, exploited per CISA KEV

    The article adds that federal agencies must patch by November 20 under Binding Operational Directive 26-04, that it is unclear whether the flaw was exploited as a zero-day before a patch existed, and that neither SonicWall nor CISA has released details of the suspected attacks. It also places the flaw in the context of CVE-2026-102255, an SMA1000 bug that hackers began targeting last month and that CISA has not yet added to KEV.

    ler a análise desta fonte

    The article adds that federal agencies must patch by November 20 under Binding Operational Directive 26-04, that it is unclear whether the flaw was exploited as a zero-day before a patch existed, and that neither SonicWall nor CISA has released details of the suspected attacks. It also places the flaw in the context of CVE-2026-102255, an SMA1000 bug that hackers began targeting last month and that CISA has not yet added to KEV.

    SonicWall published advisory SNWLID-2026-0014 on November 6, 2026, fixing CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSLVPN service. A user holding valid credentials for an alternate login method can skip the SAML checks, including SAML-enforced MFA (securityweek.com). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a November 20 deadline for federal agencies under Binding Operational Directive 26-04 (securityweek.com). SonicWall's PSIRT says only that it investigated a report of potential exploitation, and neither the vendor nor CISA has published details of the suspected attacks or said whether the flaw was used as a zero-day (securityweek.com, helpnetsecurity.com). The vendor rates the flaw CVSS 7.1 (cyberpress.org); it is exposed only when SAML is enabled for SSLVPN logins, and attackers need working credentials first (helpnetsecurity.com), which is why urgency is rated high rather than critical despite the KEV listing. The same advisory fixes six other SonicOS flaws that the article does not mark as exploited.

    Technical Details

    • The CVE record classifies the bug as CWE-308, single-factor authentication, and the vendor scores it CVSS 7.1 (cyberpress.org).
    • The flaw affects SSLVPN only when SAML is enabled for SSLVPN logins (helpnetsecurity.com, cyberpress.org).
    • Affected are Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 and older, and Gen8 TZ, NSa and NSv firewalls on SonicOS 8.2.2-8015 and older (securityweek.com).
    • Of the six companion flaws, two are rated 8.8 and affect the management interface, three are pre-authentication buffer overflows or related memory bugs in the SSL VPN and TACACS+ client, and one is a weak password hashing issue in virtual appliances (securityweek.com).

    Remediation

    • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later and Gen8 firewalls to SonicOS 8.2.3-8015 or later (securityweek.com, cyberpress.org).
    • The NSv virtual firewall may not yet have a Gen7 7.3.4 build; the initial Gen 7 release notes said so (esecurityplanet.com), so check platform availability before planning.
    • SonicWall states there is no workaround, so upgrading is the only fix (securityweek.com).
    • Where SAML is enabled on SSLVPN, review logs for logins that appear to have skipped MFA checks (securityonline.info).
  4. bleepingcomputer.com ↗ · pub. 06/11/2026 21:00 · coletado 06/11 22:00

    SonicWall SonicOS SSLVPN SAML authentication bypass CVE-2026-19868 exploited, added to CISA KEV

    This article brings no new victims, IOCs or patches. Its relevant addition is a correction: it reports that SonicWall only investigated a report of potential exploitation, so the earlier case wording that advisory SNWLID-2026-0014 confirmed real-world abuse is withdrawn, and the confirmation of exploitation rests on the CISA KEV listing (bleepingcomputer.com). It also places the flaw within the recent run of attacks against SonicWall SMA1000 appliances, including the October exploitation attempts against CVE-2026-102255 (bleepingcomputer.com).

    ler a análise desta fonte

    This article brings no new victims, IOCs or patches. Its relevant addition is a correction: it reports that SonicWall only investigated a report of potential exploitation, so the earlier case wording that advisory SNWLID-2026-0014 confirmed real-world abuse is withdrawn, and the confirmation of exploitation rests on the CISA KEV listing (bleepingcomputer.com). It also places the flaw within the recent run of attacks against SonicWall SMA1000 appliances, including the October exploitation attempts against CVE-2026-102255 (bleepingcomputer.com).

    SonicWall has fixed seven flaws in SonicOS firewalls, and the one that matters most to defenders is CVE-2026-19868, an authentication bypass in the SonicOS SSLVPN service (bleepingcomputer.com). A user who already holds valid credentials for an alternate login method can skip the SAML checks, including SAML-enforced MFA, and the flaw carries a CVSS score of 7.1 (bleepingcomputer.com). Only SSLVPN services configured to use SAML are exposed, a non-default setup that narrows the population at risk (bleepingcomputer.com). SonicWall's PSIRT says it investigated a report of potential exploitation but has shared no details, while CISA placed the CVE in its KEV catalog on November 6, 2026, with a federal remediation deadline of November 20 (bleepingcomputer.com, cybersecuritynews.com). The same bulletin fixes six other SonicOS flaws, and urgency is rated high rather than critical because exploitation is confirmed, but the attack needs valid credentials for another method and SonicWall states that no workaround exists (bleepingcomputer.com, github.com/foxcornlab/sonicwall-sonicos-scanner).

    Technical Details

    • CVE-2026-19868 is an authentication enforcement weakness classified as CWE-308, single-factor authentication in the SSLVPN service (github.com/foxcornlab/sonicwall-sonicos-scanner).
    • Two management-interface flaws rated 8.8 let unauthenticated attackers run unauthorized operations under specific conditions. The other flaws are pre-authentication buffer overflows in SSL-VPN and TACACS+ that can cause denial of service, and weak password hashing on virtual appliances (bleepingcomputer.com).
    • The affected builds are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier (bleepingcomputer.com).

    Remediation

    • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later, and Gen8 firewalls to SonicOS 8.2.3-8015 or later (bleepingcomputer.com).
    • No workaround exists, so patching is the only fix (bleepingcomputer.com).
  5. securityonline.info ↗ · pub. 06/11/2026 19:50 · coletado 06/11 20:00 primeiro registro

    SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 exploited in the wild, added to CISA KEV

    ler a análise desta fonte

    SonicWall has disclosed CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSLVPN service that lets a user holding valid credentials for an alternate login method skip SAML checks, including SAML-enforced MFA (securityweek.com). CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal deadline of November 20 (securityweek.com). Where the article says advisory SNWLID-2026-0014 confirms real-world abuse, SonicWall's own wording only says its PSIRT investigated a report of potential exploitation, and neither the vendor nor CISA has shared details of the suspected attacks (securityweek.com). The advisory covers seven SonicOS flaws, and the article reports CVSS scores of 8.8 for two management-portal bugs and between 7.5 and 5.2 for the rest (securityonline.info); no confirmed exploitation was found for the other six. Urgency is rated high rather than critical because exploitation is confirmed but the bypass needs valid credentials for another method and a non-default SAML setup on SSLVPN, and SonicWall offers no workaround, so patching is the only fix.

    Technical Details

    • CVE-2026-19868 carries a CVSS 7.1 score per the vendor, and the article labels it CWE-308. It affects the SSLVPN service only when SAML is enabled for SSLVPN logins (securityweek.com, securityonline.info).
    • CVE-2026-107155 (loose cross-domain policy, CWE-942) and CVE-2026-107154 (IP session checks, CWE-291) are both rated 8.8 and let remote attackers run unauthorized tasks when certain settings are enabled (securityonline.info).
    • CVE-2026-82308 (CVSS 7.5) is a pre-authentication heap overflow in SSL-VPN. CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9) are stack and heap overflows in the TACACS+ client. CVE-2026-19703 (CVSS 5.2) lets local users read a limited password on virtual hosts because of weak hashing (securityonline.info).
    • Affected are Gen7 physical and virtual firewalls on SonicOS 7.3.3-7015 and older, and Gen8 physical and virtual firewalls on SonicOS 8.2.2-8015 and older (sonicwall.com). Press coverage lists the affected models as TZ, NSa, NSsp and NSv (securityweek.com).

    Remediation

    • Move Gen7 firewalls to SonicOS 7.3.4-7013 or later. The advisory table dates 7.3.4-7013 to October 20, 2026 and 7.3.4-7015 to November 5, 2026 (sonicwall.com).
    • Move Gen8 firewalls to SonicOS 8.2.3-8015 or later, which the advisory table lists as scheduled for November 6, 2026 (sonicwall.com).
    • SonicWall states that no workarounds exist for these flaws (securityweek.com).
    • Gen6 and older firmware is end of support, so those devices need replacing with a Gen8 unit (sonicwall.com).
    • Where SAML is enabled on SSLVPN, review logs for logins that appear to have skipped MFA checks (securityonline.info).

Repetiram sem novidade