SonicWall has issued security updates for a high-severity SonicOS flaw that could allow attackers to circumvent SAML authentication protections for SSL VPN access. The company said it investigated a report suggesting the vulnerability may have been exploited.
Tracked as CVE-2026-19868, the issue affects the SSL VPN service in SonicOS, the operating system used by SonicWall firewall appliances. An attacker with valid credentials for an alternative authentication method could potentially bypass SAML-based login requirements, according to SonicWall. This could also defeat multi-factor authentication when MFA is enforced through SAML.
The vulnerability has a CVSS severity score of 7.1 and was reported by Ryan Harris of The Electronic Office. Exposure is limited to deployments where SAML authentication has been enabled for SSL VPN access.
The U.S. Cybersecurity and Infrastructure Security Agency added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6. Federal civilian agencies subject to Binding Operational Directive 26-04 have until November 20 to remediate the issue. Neither CISA nor SonicWall has released technical details about the reported exploitation or identified the actors involved.
Affected Versions and Updates
The vulnerability affects the following SonicWall products and releases:
- Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or earlier
- Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or earlier
SonicWall said the issue is fixed in SonicOS versions 7.3.4-7013 and 8.2.3-8015. The vendor did not provide a workaround and urged customers to install the updated software promptly.
The advisory also covers six additional flaws. Two vulnerabilities, each rated 8.8 on the CVSS scale, affect SonicOS management interfaces and may enable unauthenticated remote actions in certain conditions. Other issues include pre-authentication buffer overflows that could cause application-level denial-of-service conditions, as well as a weak password-hashing weakness affecting virtual appliances. SonicWall did not identify those additional vulnerabilities as exploited.