SonicOS SSL-VPN SAML Bypass Exploited, Patch Now

SonicWall has released updates for seven vulnerabilities in SonicOS firewalls, and one of them is already being exploited. BleepingComputer reported on November 6 that CVE-2026-19868 lets an attacker who holds valid credentials for an alternate authentication method get around SAML authentication controls, potentially including SAML-enforced multi-factor authentication.

What is affected and what to do

The flaw has a CVSS score of 7.1 and only matters on SonicOS SSL-VPN services configured to use SAML authentication. SonicWall’s advisory says its PSIRT investigated a report of potential exploitation and urges customers to upgrade as soon as possible. The company has not shared details of the attack. CISA has added the flaw to its Known Exploited Vulnerabilities catalog, which confirms exploitation in the wild, and set a November 20, 2026 deadline for federal civilian agencies.

• Affected: SonicOS Gen7 7.3.3-7015 and earlier, and Gen8 8.2.2-8015 and earlier.
• Fixed: Gen7 7.3.4-7013 and Gen8 8.2.3-8015.
• Workarounds: SonicWall says none are available, so the update is the mitigation.

The same advisory fixes six other flaws. Two are management interface issues rated 8.8 that let unauthenticated attackers perform unauthorized operations under specific conditions. The rest are pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that can cause denial of service, and a weak password hashing issue affecting virtual appliances. One update covers all seven.

Analysis

A 7.1 looks modest, and it will probably sit in a lot of patch queues for that reason. The score leans on the requirement for valid credentials, but SAML MFA exists so that a stolen credential is not enough on its own, and a flaw that lets a different login method stand in for the SAML check undercuts that design directly. The number measures the precondition, while the exposure depends on what the control was supposed to guarantee. That gap is where severity scores tend to mislead, and with exploitation confirmed, this one sits well above its rating for any firewall that publishes SSL-VPN to the internet.

It also arrives in a hard year for the vendor’s remote access products. SonicWall’s SMA1000 appliances were hit in July and September zero-day attacks and again in October, and the company declined to patch two flaws in end-of-life GMS this week. Those are different product lines, so nothing here links them technically. Still, the pattern of edge devices carrying the authentication burden and being the first thing attackers probe is a familiar one.

More coverage is on the SonicWall topic page.