SonicWall SonicOS patches seven flaws, including CVE-2026-19868 exploited in the wild (SSLVPN SAML bypass)
SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, its firewall operating system, and the CERT-FR notice CERTFR-2026-AVI-1483 relays it on 9 November. The vendor states that CVE-2026-19868 is actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of 20 November 2026 (github.com/foxcornlab/sonicwall-sonicos-scanner; dev.to). That flaw is an SSL-VPN authentication weakness in which a user holding valid credentials for another login method can bypass SAML enforcement, so exposure is limited to SSL-VPN deployments that use SAML, and the attacker needs existing valid credentials; it is not an unauthenticated takeover. The other six flaws include two management-interface issues rated 8.8 and a pre-authentication heap overflow causing denial of service (itpro.com). No exploitation details beyond the vendor and CISA statements were found in the sources opened, so the criticity is high rather than critical.
Entenda a falha
A vulnerabilidade
SonicWall advisory SNWLID-2026-0014 fixes seven SonicOS flaws. The most severe in practice is CVE-2026-19868 (CVSS 7.1, CWE-308), which is exploited in the wild. It sits in the SSLVPN service: a user with valid credentials for another login method can bypass SAML enforcement. It only matters where SSLVPN uses SAML, and the attacker needs valid credentials, so it is not an unauthenticated takeover. The other flaws are CVE-2026-107154 (session validation) and CVE-2026-107155 (permissive cross-domain policy), both rated 8.8 in the management interface. CVE-2026-82308 is a pre-auth heap overflow causing denial of service (7.5), and CVE-2026-77708 is a pre-auth stack overflow in the TACACS+ client (5.9). CVE-2026-19703 and CVE-2026-77709 have no public details in the sources. Affected: Gen7 7.3.3-7015 and earlier (fixed in 7.3.4-7013) and Gen8 8.2.2-8015 and earlier (fixed in 8.2.3-8015).
Como funciona
For CVE-2026-19868, the firewall's SSLVPN service is set to authenticate users through SAML. A user who holds valid credentials for a different authentication method reaches the login. The service accepts that login without enforcing the SAML step, so the user gets in on a single factor. The articles give no finer detail of the code path.
Por que é vulnerável
The root cause is classified as CWE-308, use of single-factor authentication: SAML is meant to be required for SSLVPN logins, but the check does not hold when another authentication method's credentials are used. The articles do not say why it went unnoticed or exactly what the patch changes beyond the fixed builds.
Como foi descoberta
SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 and states that CVE-2026-19868 is actively exploited. CISA added it to the KEV catalog the same day, with a federal deadline of 20 November 2026, and CERT-FR relayed the advisory on 9 November. The sources do not say who found the flaw or how, and give no exploitation details beyond the vendor and CISA statements.
Explicação gerada por IA a partir da matéria e dos artigos, em 09/11/2026 14:33.
Detalhes técnicos
- CVE-2026-19868 (CWE-308, use of single-factor authentication) sits in the SonicOS SSLVPN service. Its CVSS 3.1 score is 7.1 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N; the 8.8 rating belongs to the whole bulletin and must not be attributed to this CVE (rescana.com).
- Prerequisites: valid credentials for an alternate authentication method and SAML enabled for SSLVPN logins. The vendor lists no workaround (github.com/foxcornlab/sonicwall-sonicos-scanner).
- Affected builds: SonicOS Gen7 7.3.3-7015 and earlier (TZ, NSa, NSsp, NSv) and Gen8 8.2.2-8015 and earlier (TZ, NSa, NSv) (github.com/foxcornlab/sonicwall-sonicos-scanner).
- CVE-2026-107154 and CVE-2026-107155 are a session validation flaw and a permissive cross-domain policy flaw in the SonicOS management interface, both rated 8.8; the first could let a remote unauthenticated attacker perform unauthorized operations (itpro.com).
- CVE-2026-82308 is a pre-authentication heap overflow causing application-level denial of service, rated 7.5. CVE-2026-77708 is a pre-authentication stack overflow in the TACACS+ authentication client, rated 5.9 (itpro.com).
- CVE-2026-19703 and CVE-2026-77709 appear in the CERT-FR notice; no opened source gives their details.
Remediação
- Upgrade SonicOS Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later, the fixed builds given in the CERT-FR notice and the vendor-side data (github.com/foxcornlab/sonicwall-sonicos-scanner).
- Until the upgrade, check whether SSLVPN relies on SAML and review accounts that hold alternate-authentication credentials.
- Limit exposure of the management interface.
- Read bulletin SNWLID-2026-0014 for the authoritative list, since the vendor page did not render in the research.
Linha do tempo
-
SonicWall SonicOS patches seven flaws, including CVE-2026-19868 exploited in the wild (SSLVPN SAML bypass)
ler a análise desta fonte ocultar
SonicWall published advisory SNWLID-2026-0014 on 6 November 2026 covering seven vulnerabilities in SonicOS, its firewall operating system, and the CERT-FR notice CERTFR-2026-AVI-1483 relays it on 9 November. The vendor states that CVE-2026-19868 is actively exploited, and CISA added it to its Known Exploited Vulnerabilities catalog the same day with a federal remediation deadline of 20 November 2026 (github.com/foxcornlab/sonicwall-sonicos-scanner; dev.to). That flaw is an SSL-VPN authentication weakness in which a user holding valid credentials for another login method can bypass SAML enforcement, so exposure is limited to SSL-VPN deployments that use SAML, and the attacker needs existing valid credentials; it is not an unauthenticated takeover. The other six flaws include two management-interface issues rated 8.8 and a pre-authentication heap overflow causing denial of service (itpro.com). No exploitation details beyond the vendor and CISA statements were found in the sources opened, so the criticity is high rather than critical.
Technical Details
- CVE-2026-19868 (CWE-308, use of single-factor authentication) sits in the SonicOS SSLVPN service. Its CVSS 3.1 score is 7.1 with vector CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N; the 8.8 rating belongs to the whole bulletin and must not be attributed to this CVE (rescana.com).
- Prerequisites: valid credentials for an alternate authentication method and SAML enabled for SSLVPN logins. The vendor lists no workaround (github.com/foxcornlab/sonicwall-sonicos-scanner).
- Affected builds: SonicOS Gen7 7.3.3-7015 and earlier (TZ, NSa, NSsp, NSv) and Gen8 8.2.2-8015 and earlier (TZ, NSa, NSv) (github.com/foxcornlab/sonicwall-sonicos-scanner).
- CVE-2026-107154 and CVE-2026-107155 are a session validation flaw and a permissive cross-domain policy flaw in the SonicOS management interface, both rated 8.8; the first could let a remote unauthenticated attacker perform unauthorized operations (itpro.com).
- CVE-2026-82308 is a pre-authentication heap overflow causing application-level denial of service, rated 7.5. CVE-2026-77708 is a pre-authentication stack overflow in the TACACS+ authentication client, rated 5.9 (itpro.com).
- CVE-2026-19703 and CVE-2026-77709 appear in the CERT-FR notice; no opened source gives their details.
Remediation
- Upgrade SonicOS Gen7 to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later, the fixed builds given in the CERT-FR notice and the vendor-side data (github.com/foxcornlab/sonicwall-sonicos-scanner).
- Until the upgrade, check whether SSLVPN relies on SAML and review accounts that hold alternate-authentication credentials.
- Limit exposure of the management interface.
- Read bulletin SNWLID-2026-0014 for the authoritative list, since the vendor page did not render in the research.