SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 added to CISA KEV; patches released for seven flaws

Linha do tempo

1. cert.cyber.gouv.fr ↗ · pub. 08/11/2026 21:00 · coletado 09/11 14:01

   SonicWall SonicOS patches seven flaws, including CVE-2026-19868 exploited in the wild (SSLVPN SAML bypass)

   ler a análise desta fonte ocultar

   SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, its firewall operating system, and the CERT-FR notice CERTFR-2026-AVI-1483 relays it on 9 November. The vendor states that CVE-2026-19868 is actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of 20 November 2026 (github.com/foxcornlab/sonicwall-sonicos-scanner; dev.to). That flaw is an SSL-VPN authentication weakness in which a user holding valid credentials for another login method can bypass SAML enforcement, so exposure is limited to SSL-VPN deployments that use SAML, and the attacker needs existing valid credentials; it is not an unauthenticated takeover. The other six flaws include two management-interface issues rated 8.8 and a pre-authentication heap overflow causing denial of service (itpro.com). No exploitation details beyond the vendor and CISA statements were found in the sources opened, so the criticity is high rather than critical.

   Technical Details

   • CVE-2026-19868 (CWE-308, use of single-factor authentication) sits in the SonicOS SSLVPN service. Its CVSS 3.1 score is 7.1 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N; the 8.8 rating belongs to the whole bulletin and must not be attributed to this CVE (rescana.com).
   • Prerequisites: valid credentials for an alternate authentication method and SAML enabled for SSLVPN logins. The vendor lists no workaround (github.com/foxcornlab/sonicwall-sonicos-scanner).
   • Affected builds: SonicOS Gen7 7.3.3-7015 and earlier (TZ, NSa, NSsp, NSv) and Gen8 8.2.2-8015 and earlier (TZ, NSa, NSv) (github.com/foxcornlab/sonicwall-sonicos-scanner).
   • CVE-2026-107154 and CVE-2026-107155 are a session validation flaw and a permissive cross-domain policy flaw in the SonicOS management interface, both rated 8.8; the first could let a remote unauthenticated attacker perform unauthorized operations (itpro.com).
   • CVE-2026-82308 is a pre-authentication heap overflow causing application-level denial of service, rated 7.5. CVE-2026-77708 is a pre-authentication stack overflow in the TACACS+ authentication client, rated 5.9 (itpro.com).
   • CVE-2026-19703 and CVE-2026-77709 appear in the CERT-FR notice; no opened source gives their details.

   Remediation

   • Upgrade SonicOS Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later, the fixed builds given in the CERT-FR notice and the vendor-side data (github.com/foxcornlab/sonicwall-sonicos-scanner).
   • Until the upgrade, check whether SSLVPN relies on SAML and review accounts that hold alternate-authentication credentials.
   • Limit exposure of the management interface.
   • Read bulletin SNWLID-2026-0014 for the authoritative list, since the vendor page did not render in the research.
2. gbhackers.com ↗ · pub. 09/11/2026 03:20 · coletado 09/11 04:00

   SonicWall SonicOS SSL-VPN flaw CVE-2026-19868 bypasses SAML-enforced MFA; added to CISA KEV

   ler a análise desta fonte ocultar

   SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, headed by CVE-2026-19868, an SSL-VPN authentication enforcement flaw that lets a user holding valid credentials for an alternate authentication method bypass SAML controls and the MFA enforced through them. The vendor rated it CVSS 7.1 (the advisory's highest score, 8.8, belongs to other issues) and classified it as CWE-308, inconsistent authentication enforcement rather than a cryptographic break of SAML. The article states SonicWall investigated reports of potential exploitation without confirming a widespread campaign; CISA has since added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on 6 November 2026 with a federal remediation due date of 20 November 2026 (rescana.com, dev.to). Exploitation is not credentialless: it requires usable credentials on another authentication method exposed by the SSL-VPN service, and the CVSS vector records high attack complexity, which limits the practical risk for deployments without exposed alternate login paths.

   Technical Details

   The CVSS vector describes network-based exploitation, high attack complexity, low privileges required and no user interaction, with high confidentiality impact, limited integrity impact and no availability impact. Only SSL-VPN services configured for SAML authentication are affected. The same advisory lists CVE-2026-107155 (permissive cross-domain policy, 8.8) and CVE-2026-107154 (session-validation defect, 8.8), either of which could enable unauthorized management operations under specific conditions; CVE-2026-82308, a pre-authentication SSL-VPN heap overflow (7.5) causing application-level denial of service; CVE-2026-77708 and CVE-2026-77709, TACACS+ client stack and heap buffer overflows (5.9 each); and CVE-2026-19703 (5.2), weak password hashing on virtual appliances requiring existing local access.

   Remediation

   Affected Gen7 hardware and NSv appliances run SonicOS 7.3.3-7015 or earlier; affected Gen8 systems run 8.2.2-8015 or earlier. Fixed releases are Gen7 7.3.4-7013 and later and Gen8 8.2.3-8015 and later. No workaround is provided. Administrators should prioritise SAML-backed SSL-VPN deployments, verify appliance generation and firmware, and treat MFA as no substitute for patching where an alternate authentication method remains reachable.

3. thehackernews.com ↗ · pub. 09/11/2026 03:05 · coletado 09/11 04:00

   SonicWall SonicOS SSL-VPN SAML/MFA bypass CVE-2026-19868 exploited, added to CISA KEV

   The article adds that SonicWall, days before the KEV addition, detailed two unpatched flaws in end-of-life Global Management System (GMS) systems, CVE-2026-109593 and CVE-2026-109594, and urged customers to upgrade to Network Security Manager (NSM) (thehackernews.com). It also frames the KEV addition as following reports that the flaw may have been exploited, a more cautious wording than the listing itself.

   ler a análise desta fonte ocultar

   The article adds that SonicWall, days before the KEV addition, detailed two unpatched flaws in end-of-life Global Management System (GMS) systems, CVE-2026-109593 and CVE-2026-109594, and urged customers to upgrade to Network Security Manager (NSM) (thehackernews.com). It also frames the KEV addition as following reports that the flaw may have been exploited, a more cautious wording than the listing itself.

   SonicWall has patched CVE-2026-19868, a high-severity authentication enforcement flaw in the SonicOS SSL-VPN service, and CISA has added it to its Known Exploited Vulnerabilities (KEV) catalog after reports that it may have been used in real-world attacks (thehackernews.com). The flaw lets a user with valid credentials for an alternate authentication method bypass SAML controls, and successful exploitation may also bypass SAML-enforced MFA (thehackernews.com). The vendor scores it 7.1 (helpnetsecurity.com), while the article gives 7.1 / 7.5 without attribution. The same advisory covers two 8.8 flaws in the management interface, CVE-2026-107155 and CVE-2026-107154, and a pre-authentication heap overflow in SSL-VPN, CVE-2026-82308, rated 7.5 (thehackernews.com). SonicWall has not described the attacks or who is behind them (thehackernews.com), and the bypass needs valid credentials plus SAML enabled on SSL-VPN, which limits the immediate risk (helpnetsecurity.com). Days earlier, SonicWall flagged two unpatched flaws in end-of-life GMS systems and urged customers to move to Network Security Manager (NSM) (thehackernews.com).

   Remediation

   • Apply the SonicWall fix for your platform; the vendor lists no workarounds (helpnetsecurity.com).
   • Federal Civilian Executive Branch agencies must patch by November 20, 2026 (thehackernews.com).
4. securityweek.com ↗ · pub. 07/11/2026 07:16 · coletado 07/11 08:00

   SonicWall patches SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868, exploited per CISA KEV

   The article adds that federal agencies must patch by November 20 under Binding Operational Directive 26-04, that it is unclear whether the flaw was exploited as a zero-day before a patch existed, and that neither SonicWall nor CISA has released details of the suspected attacks. It also places the flaw in the context of CVE-2026-102255, an SMA1000 bug that hackers began targeting last month and that CISA has not yet added to KEV.

   ler a análise desta fonte ocultar

   The article adds that federal agencies must patch by November 20 under Binding Operational Directive 26-04, that it is unclear whether the flaw was exploited as a zero-day before a patch existed, and that neither SonicWall nor CISA has released details of the suspected attacks. It also places the flaw in the context of CVE-2026-102255, an SMA1000 bug that hackers began targeting last month and that CISA has not yet added to KEV.

   SonicWall published advisory SNWLID-2026-0014 on November 6, 2026, fixing CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSLVPN service. A user holding valid credentials for an alternate login method can skip the SAML checks, including SAML-enforced MFA (securityweek.com). CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a November 20 deadline for federal agencies under Binding Operational Directive 26-04 (securityweek.com). SonicWall's PSIRT says only that it investigated a report of potential exploitation, and neither the vendor nor CISA has published details of the suspected attacks or said whether the flaw was used as a zero-day (securityweek.com, helpnetsecurity.com). The vendor rates the flaw CVSS 7.1 (cyberpress.org); it is exposed only when SAML is enabled for SSLVPN logins, and attackers need working credentials first (helpnetsecurity.com), which is why urgency is rated high rather than critical despite the KEV listing. The same advisory fixes six other SonicOS flaws that the article does not mark as exploited.

   Technical Details

   • The CVE record classifies the bug as CWE-308, single-factor authentication, and the vendor scores it CVSS 7.1 (cyberpress.org).
   • The flaw affects SSLVPN only when SAML is enabled for SSLVPN logins (helpnetsecurity.com, cyberpress.org).
   • Affected are Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 and older, and Gen8 TZ, NSa and NSv firewalls on SonicOS 8.2.2-8015 and older (securityweek.com).
   • Of the six companion flaws, two are rated 8.8 and affect the management interface, three are pre-authentication buffer overflows or related memory bugs in the SSL VPN and TACACS+ client, and one is a weak password hashing issue in virtual appliances (securityweek.com).

   Remediation

   • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later and Gen8 firewalls to SonicOS 8.2.3-8015 or later (securityweek.com, cyberpress.org).
   • The NSv virtual firewall may not yet have a Gen7 7.3.4 build; the initial Gen 7 release notes said so (esecurityplanet.com), so check platform availability before planning.
   • SonicWall states there is no workaround, so upgrading is the only fix (securityweek.com).
   • Where SAML is enabled on SSLVPN, review logs for logins that appear to have skipped MFA checks (securityonline.info).
5. bleepingcomputer.com ↗ · pub. 06/11/2026 21:00 · coletado 06/11 22:00

   SonicWall SonicOS SSLVPN SAML authentication bypass CVE-2026-19868 exploited, added to CISA KEV

   This article brings no new victims, IOCs or patches. Its relevant addition is a correction: it reports that SonicWall only investigated a report of potential exploitation, so the earlier case wording that advisory SNWLID-2026-0014 confirmed real-world abuse is withdrawn, and the confirmation of exploitation rests on the CISA KEV listing (bleepingcomputer.com). It also places the flaw within the recent run of attacks against SonicWall SMA1000 appliances, including the October exploitation attempts against CVE-2026-102255 (bleepingcomputer.com).

   ler a análise desta fonte ocultar

   This article brings no new victims, IOCs or patches. Its relevant addition is a correction: it reports that SonicWall only investigated a report of potential exploitation, so the earlier case wording that advisory SNWLID-2026-0014 confirmed real-world abuse is withdrawn, and the confirmation of exploitation rests on the CISA KEV listing (bleepingcomputer.com). It also places the flaw within the recent run of attacks against SonicWall SMA1000 appliances, including the October exploitation attempts against CVE-2026-102255 (bleepingcomputer.com).

   SonicWall has fixed seven flaws in SonicOS firewalls, and the one that matters most to defenders is CVE-2026-19868, an authentication bypass in the SonicOS SSLVPN service (bleepingcomputer.com). A user who already holds valid credentials for an alternate login method can skip the SAML checks, including SAML-enforced MFA, and the flaw carries a CVSS score of 7.1 (bleepingcomputer.com). Only SSLVPN services configured to use SAML are exposed, a non-default setup that narrows the population at risk (bleepingcomputer.com). SonicWall's PSIRT says it investigated a report of potential exploitation but has shared no details, while CISA placed the CVE in its KEV catalog on November 6, 2026, with a federal remediation deadline of November 20 (bleepingcomputer.com, cybersecuritynews.com). The same bulletin fixes six other SonicOS flaws, and urgency is rated high rather than critical because exploitation is confirmed, but the attack needs valid credentials for another method and SonicWall states that no workaround exists (bleepingcomputer.com, github.com/foxcornlab/sonicwall-sonicos-scanner).

   Technical Details

   • CVE-2026-19868 is an authentication enforcement weakness classified as CWE-308, single-factor authentication in the SSLVPN service (github.com/foxcornlab/sonicwall-sonicos-scanner).
   • Two management-interface flaws rated 8.8 let unauthenticated attackers run unauthorized operations under specific conditions. The other flaws are pre-authentication buffer overflows in SSL-VPN and TACACS+ that can cause denial of service, and weak password hashing on virtual appliances (bleepingcomputer.com).
   • The affected builds are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier (bleepingcomputer.com).

   Remediation

   • Upgrade Gen7 firewalls to SonicOS 7.3.4-7013 or later, and Gen8 firewalls to SonicOS 8.2.3-8015 or later (bleepingcomputer.com).
   • No workaround exists, so patching is the only fix (bleepingcomputer.com).
6. securityonline.info ↗ · pub. 06/11/2026 19:50 · coletado 06/11 20:00 primeiro registro

   SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 exploited in the wild, added to CISA KEV

   ler a análise desta fonte ocultar

   SonicWall has disclosed CVE-2026-19868, an authentication enforcement flaw in the SonicOS SSLVPN service that lets a user holding valid credentials for an alternate login method skip SAML checks, including SAML-enforced MFA (securityweek.com). CISA added the flaw to its Known Exploited Vulnerabilities catalog on November 6, 2026, with a federal deadline of November 20 (securityweek.com). Where the article says advisory SNWLID-2026-0014 confirms real-world abuse, SonicWall's own wording only says its PSIRT investigated a report of potential exploitation, and neither the vendor nor CISA has shared details of the suspected attacks (securityweek.com). The advisory covers seven SonicOS flaws, and the article reports CVSS scores of 8.8 for two management-portal bugs and between 7.5 and 5.2 for the rest (securityonline.info); no confirmed exploitation was found for the other six. Urgency is rated high rather than critical because exploitation is confirmed but the bypass needs valid credentials for another method and a non-default SAML setup on SSLVPN, and SonicWall offers no workaround, so patching is the only fix.

   Technical Details

   • CVE-2026-19868 carries a CVSS 7.1 score per the vendor, and the article labels it CWE-308. It affects the SSLVPN service only when SAML is enabled for SSLVPN logins (securityweek.com, securityonline.info).
   • CVE-2026-107155 (loose cross-domain policy, CWE-942) and CVE-2026-107154 (IP session checks, CWE-291) are both rated 8.8 and let remote attackers run unauthorized tasks when certain settings are enabled (securityonline.info).
   • CVE-2026-82308 (CVSS 7.5) is a pre-authentication heap overflow in SSL-VPN. CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9) are stack and heap overflows in the TACACS+ client. CVE-2026-19703 (CVSS 5.2) lets local users read a limited password on virtual hosts because of weak hashing (securityonline.info).
   • Affected are Gen7 physical and virtual firewalls on SonicOS 7.3.3-7015 and older, and Gen8 physical and virtual firewalls on SonicOS 8.2.2-8015 and older (sonicwall.com). Press coverage lists the affected models as TZ, NSa, NSsp and NSv (securityweek.com).

   Remediation

   • Move Gen7 firewalls to SonicOS 7.3.4-7013 or later. The advisory table dates 7.3.4-7013 to October 20, 2026 and 7.3.4-7015 to November 5, 2026 (sonicwall.com).
   • Move Gen8 firewalls to SonicOS 8.2.3-8015 or later, which the advisory table lists as scheduled for November 6, 2026 (sonicwall.com).
   • SonicWall states that no workarounds exist for these flaws (securityweek.com).
   • Gen6 and older firmware is end of support, so those devices need replacing with a Gen8 unit (sonicwall.com).
   • Where SAML is enabled on SSLVPN, review logs for logins that appear to have skipped MFA checks (securityonline.info).

Repetiram sem novidade

• helpnetsecurity.com — SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 exploited in the wild, added to CISA KEV
• securityaffairs.com — SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 added to CISA KEV with confirmed exploitation
• gbhackers.com — SonicWall SonicOS SSLVPN SAML/MFA bypass CVE-2026-19868 added to CISA KEV