SonicWall patches actively exploited SSL-VPN SAML bypass
SonicWall fixed seven SonicOS flaws including a SAML/MFA bypass (CVE-2026-19868) already exploited in the wild and added to CISA's KEV list.
Sourceadvisories.ncsc.nl — open the original
What to check
- Applies to
- The 7 CVEs named below. Whether you run an affected version is not assessed: check the versions the source lists.
- Exploitation
- CISA lists CVE-2026-19868 as exploited in the wild.
NCSC-NL published an advisory summarizing seven vulnerabilities SonicWall has patched in SonicOS for Gen7 and Gen8 firewalls. The most urgent, CVE-2026-19868, is an authentication-enforcement flaw in the SSL-VPN feature that lets an attacker who holds valid credentials for an alternate authentication method remotely bypass SAML-based authentication, thereby also bypassing SAML-enforced MFA. SonicWall has investigated reports of possible active exploitation and the vulnerability has since been added to CISA's Known Exploited Vulnerabilities catalog, indicating real-world abuse against SonicWall firewalls.
Two additional high-severity issues (CVE-2026-107154 and CVE-2026-107155, CVSS 8.8) affect the SonicOS management interface: a session-validation error and an improperly secured cross-domain policy that an unauthenticated attacker could exploit remotely under specific conditions, though user interaction is required to perform unauthorized actions. CVE-2026-82308 is a heap-based buffer overflow in SSL-VPN that an unauthenticated attacker can trigger remotely to cause denial of service. The remaining three issues involve two buffer overflows in the TACACS+ authentication functionality (which can also cause service disruption) and weak password hashing on virtual SonicOS appliances, which could let an attacker with existing local access recover a platform credential.
SonicWall has released firmware updates addressing all seven vulnerabilities. Given confirmed active exploitation of the SAML/MFA bypass and its inclusion in CISA KEV, defenders operating SonicWall SonicOS Gen7/Gen8 firewalls with SSL-VPN and SAML/MFA enabled should prioritize patching and review authentication logs for anomalous SAML bypass activity or logins using alternate authentication methods.
Mentioned in this report
Source reporting: https://advisories.ncsc.nl/2026/ncsc-2026-0471.html
Free public brief. Slack alerts on the vendors you run come with the paid plans, and a new account gets three days of them, no card.
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries live profiles of the CVEs it names. The paid plans add the security research and news reporting the free tier leaves out.
It sits in a corpus of 16,445 reports from 149 sources, 666 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Slack alerts are a paid-plan feature: name the vendors you run and Slack hears about the reports that touch them, not the rest of the week's. Nothing is charged unless you subscribe.
Create a free account What it costs