SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 bypasses SAML-enforced MFA; added to CISA KEV
SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, headed by CVE-2026-19868, an SSL-VPN authentication enforcement flaw that lets a user holding valid credentials for an alternate authentication method bypass SAML controls and the MFA enforced through them. The vendor rated it CVSS 7.1 (the advisory's highest score, 8.8, belongs to other issues) and classified it as CWE-308, inconsistent authentication enforcement rather than a cryptographic break of SAML. The article states SonicWall investigated reports of potential exploitation without confirming a widespread campaign; CISA has since added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026 with a federal remediation due date of 20 November 2026 (rescana.com, dev.to). Exploitation is not credentialless: it requires usable credentials on another authentication method exposed by the SSL-VPN service, and the CVSS vector records high attack complexity, which limits the practical risk for deployments without exposed alternate login paths.
Entenda a falha
A vulnerabilidade
CVE-2026-19868 is an authentication enforcement flaw in the SonicOS SSL-VPN (CVSS 7.1, CWE-308). It affects only SSL-VPN services configured for SAML. A user with valid credentials for another authentication method exposed by the same service can bypass SAML controls and the MFA enforced through them. It is network-reachable with low privileges, high attack complexity and no user interaction, and the impact is high confidentiality and limited integrity. Affected: Gen7 and NSv on 7.3.3-7015 or earlier, Gen8 on 8.2.2-8015 or earlier. Fixed: Gen7 7.3.4-7013 and later, Gen8 8.2.3-8015 and later, with no workaround. The same advisory (SNWLID-2026-0014) lists CVE-2026-107155 (permissive cross-domain policy) and CVE-2026-107154 (session-validation defect), both 8.8 and possibly allowing unauthorized management operations. It also lists CVE-2026-82308 (pre-auth SSL-VPN heap overflow causing DoS, 7.5), CVE-2026-77708 and CVE-2026-77709 (TACACS+ client stack and heap overflows, 5.9) and CVE-2026-19703 (weak password hashing on virtual appliances, needs local access, 5.2).
Como funciona
A user connects to an SSL-VPN service that is set up to authenticate through SAML, with MFA handled by the identity provider. The same service also exposes another authentication method. According to the articles, the firmware does not consistently enforce the intended SAML policy. When valid credentials for the alternate method are presented, the login is accepted without going through SAML, so the identity provider's MFA step is never applied. The articles do not give finer internal detail.
Por que é vulnerável
The root cause is inconsistent authentication enforcement (CWE-308). The firmware fails to enforce the intended authentication policy when an alternate login path is reachable, so the SAML requirement can be sidestepped. The articles stress this is not a cryptographic break of SAML itself. The fix is in the patched firmware releases, but the articles do not describe what changed in the code.
Como foi descoberta
The articles do not say who found the flaw or how. SonicWall published advisory SNWLID-2026-0014 on 6 November 2026. The vendor says it investigated reports of potential exploitation but did not confirm a widespread campaign. Per the story, citing rescana.com and dev.to, CISA added CVE-2026-19868 to its KEV catalog on 6 November 2026 with a remediation due date of 20 November 2026.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 04:16.
Detalhes técnicos
The CVSS vector describes network-based exploitation, high attack complexity, low privileges required and no user interaction, with high confidentiality impact, limited integrity impact and no availability impact. Only SSL-VPN services configured for SAML authentication are affected. The same advisory lists CVE-2026-107155 (permissive cross-domain policy, 8.8) and CVE-2026-107154 (session-validation defect, 8.8), either of which could enable unauthorized management operations under specific conditions; CVE-2026-82308, a pre-authentication SSL-VPN heap overflow (7.5) causing application-level denial of service; CVE-2026-77708 and CVE-2026-77709, TACACS+ client stack and heap buffer overflows (5.9 each); and CVE-2026-19703 (5.2), weak password hashing on virtual appliances requiring existing local access.
Remediação
Affected Gen7 hardware and NSv appliances run SonicOS 7.3.3-7015 or earlier; affected Gen8 systems run 8.2.2-8015 or earlier. Fixed releases are Gen7 7.3.4-7013 and later and Gen8 8.2.3-8015 and later. No workaround is provided. Administrators should prioritise SAML-backed SSL-VPN deployments, verify appliance generation and firmware, and treat MFA as no substitute for patching where an alternate authentication method remains reachable.
Linha do tempo
-
SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 bypasses SAML-enforced MFA; added to CISA KEV
ler a análise desta fonte ocultar
SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, headed by CVE-2026-19868, an SSL-VPN authentication enforcement flaw that lets a user holding valid credentials for an alternate authentication method bypass SAML controls and the MFA enforced through them. The vendor rated it CVSS 7.1 (the advisory's highest score, 8.8, belongs to other issues) and classified it as CWE-308, inconsistent authentication enforcement rather than a cryptographic break of SAML. The article states SonicWall investigated reports of potential exploitation without confirming a widespread campaign; CISA has since added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026 with a federal remediation due date of 20 November 2026 (rescana.com, dev.to). Exploitation is not credentialless: it requires usable credentials on another authentication method exposed by the SSL-VPN service, and the CVSS vector records high attack complexity, which limits the practical risk for deployments without exposed alternate login paths.
Technical Details
The CVSS vector describes network-based exploitation, high attack complexity, low privileges required and no user interaction, with high confidentiality impact, limited integrity impact and no availability impact. Only SSL-VPN services configured for SAML authentication are affected. The same advisory lists CVE-2026-107155 (permissive cross-domain policy, 8.8) and CVE-2026-107154 (session-validation defect, 8.8), either of which could enable unauthorized management operations under specific conditions; CVE-2026-82308, a pre-authentication SSL-VPN heap overflow (7.5) causing application-level denial of service; CVE-2026-77708 and CVE-2026-77709, TACACS+ client stack and heap buffer overflows (5.9 each); and CVE-2026-19703 (5.2), weak password hashing on virtual appliances requiring existing local access.
Remediation
Affected Gen7 hardware and NSv appliances run SonicOS 7.3.3-7015 or earlier; affected Gen8 systems run 8.2.2-8015 or earlier. Fixed releases are Gen7 7.3.4-7013 and later and Gen8 8.2.3-8015 and later. No workaround is provided. Administrators should prioritise SAML-backed SSL-VPN deployments, verify appliance generation and firmware, and treat MFA as no substitute for patching where an alternate authentication method remains reachable.