# SonicWall SonicOS flaws enable auth bypass

Published: 2026-11-10 · Severity: high
Canonical: https://vorant.io/reports/b25202f2-d10f-53cc-8024-f7133eb0d991/sonicwall-patches-actively-exploited-ssl-vpn-saml-bypass
Vorant's rating weighs the evidence in the report: confirmed exploitation, victims claimed, CVSS and EPSS, and how many sources agree. It rates the report, not your assets.

> SonicWall SonicOS has multiple vulnerabilities, including an actively exploited SAML/MFA bypass (CVE-2026-19868) now in CISA's KEV catalog.

Source: cisecurity.org — https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sonicos-could-allow-for-authentication-bypass_2026-126

## What to check

- Applies to: The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation: CISA lists CVE-2026-19868 as exploited in the wild.

CIS/MS-ISAC issued an advisory covering seven vulnerabilities in SonicWall SonicOS, the operating system running SonicWall Gen7 and Gen8 hardware firewalls and NSv virtual appliances. The flaws include a session validation issue and a permissive cross-domain policy issue in the management interface, a weak password hashing issue exposing a platform credential to local attackers, pre-authentication buffer overflow bugs in the SSLVPN and TACACS+ authentication client (leading to denial of service), and most notably an authentication enforcement flaw in the SSLVPN service that allows a user holding valid credentials for an alternate authentication method to bypass SAML authentication and potentially SAML-enforced MFA.

SonicWall has confirmed a report of potential exploitation of the SAML/MFA bypass (CVE-2026-19868), and CISA added it to the Known Exploited Vulnerabilities catalog on 11/06/2026. No exploitation has been reported for the other six CVEs. Affected versions are SonicOS Gen7 Hardware Firewalls/NSv 7.3.3-7015 and earlier, and Gen8 Hardware Firewalls/NSv 8.2.2-8015 and earlier. Organizations exposing SonicOS management interfaces or SSLVPN to the internet face elevated risk, particularly where SAML is used for SSLVPN authentication.

Defenders should prioritize patching to vendor-fixed versions, restrict internet exposure of management and SSLVPN interfaces, review SSLVPN login logs for anomalous authentication paths that bypass SAML/MFA, and apply network segmentation and least-privilege controls per CIS Safeguards referenced in the advisory.

## Mentioned in this report

- Vulnerabilities: CVE-2026-107154, CVE-2026-107155, CVE-2026-19703, CVE-2026-19868 (KEV), CVE-2026-77708, CVE-2026-77709, CVE-2026-82308

Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sonicos-could-allow-for-authentication-bypass_2026-126

---

This is the free public brief from Vorant Threat Intelligence. When citing, attribute "Vorant" and link https://vorant.io/reports/943c630f-8a9a-53fc-8ee6-0c2c2155213c/sonicwall-sonicos-flaws-enable-auth-bypass.
In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out. Slack alerts on the vendors, sectors and countries a reader follows come with the paid plans too. A new account starts with a three-day trial, no card: https://vorant.io/signup