SonicWall SonicOS flaws enable auth bypass
SonicWall SonicOS has multiple vulnerabilities, including an actively exploited SAML/MFA bypass (CVE-2026-19868) now in CISA's KEV catalog.
Sourcecisecurity.org — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-19868 as exploited in the wild.
CIS/MS-ISAC issued an advisory covering seven vulnerabilities in SonicWall SonicOS, the operating system running SonicWall Gen7 and Gen8 hardware firewalls and NSv virtual appliances. The flaws include a session validation issue and a permissive cross-domain policy issue in the management interface, a weak password hashing issue exposing a platform credential to local attackers, pre-authentication buffer overflow bugs in the SSLVPN and TACACS+ authentication client (leading to denial of service), and most notably an authentication enforcement flaw in the SSLVPN service that allows a user holding valid credentials for an alternate authentication method to bypass SAML authentication and potentially SAML-enforced MFA.
SonicWall has confirmed a report of potential exploitation of the SAML/MFA bypass (CVE-2026-19868), and CISA added it to the Known Exploited Vulnerabilities catalog on 11/06/2026. No exploitation has been reported for the other six CVEs. Affected versions are SonicOS Gen7 Hardware Firewalls/NSv 7.3.3-7015 and earlier, and Gen8 Hardware Firewalls/NSv 8.2.2-8015 and earlier. Organizations exposing SonicOS management interfaces or SSLVPN to the internet face elevated risk, particularly where SAML is used for SSLVPN authentication.
Defenders should prioritize patching to vendor-fixed versions, restrict internet exposure of management and SSLVPN interfaces, review SSLVPN login logs for anomalous authentication paths that bypass SAML/MFA, and apply network segmentation and least-privilege controls per CIS Safeguards referenced in the advisory.
Mentioned in this report
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sonicos-could-allow-for-authentication-bypass_2026-126
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,436 reports from 149 sources, 661 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs