// AI threat desk · 15 Nov 2026
Home/CVE · Vulns & Patches
Vulns & PatchesHighMFACVSS 8.8 / 7.1

SonicWall patched CVE-2026-19868 SAML authentication-bypass flaw

SonicWall patched a SonicOS SSL VPN flaw that can bypass SAML authentication and may have been exploited in attacks, SecurityWeek said. Ryan Harris of The Electronic Office reported it.

· 2 min read
AI-generated image of security analysts monitoring VPN systems in a dim operations centre.
AI-generated image, not a photo of the event.
Key takeaways
  • SecurityWeek said CVE-2026-19868 affects the SonicOS SSL VPN component and can bypass SAML authentication.
  • SonicWall investigated a report indicating potential exploitation of the vulnerability.
  • SecurityWeek said SonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the issue, with no workarounds available.

SonicWall has patched a SonicOS vulnerability that can be used to bypass SAML authentication and may have been exploited in attacks, SecurityWeek said.

The flaw, tracked as CVE-2026-19868, affects the SSL VPN component of SonicOS, the operating system that runs on SonicWall firewalls. An SSL VPN is exposed only when SAML-based login is enabled, according to SonicWall.

SonicWall is an American cybersecurity company that sells internet appliances primarily for content control and network security. CISA lists CVE-2026-19868 as a SonicWall SonicOS SSLVPN use-of-single-factor-authentication vulnerability.

On this page

SonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the flaw

SecurityWeek said the vulnerability has a CVSS score of 7.1, placing it in the high-severity range. It can bypass SAML authentication.

The affected Gen7 devices are TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older. The affected Gen8 devices are TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older.

Device generationAffected versionResolving version
Gen7 TZ, NSa, NSsp and NSvSonicOS 7.3.3-7015 or olderSonicOS 7.3.4-7013
Gen8 TZ, NSa and NSvSonicOS 8.2.2-8015 or olderSonicOS 8.2.3-8015

SonicWall fixed seven SonicOS vulnerabilities

BleepingComputer said SonicWall included the SSL VPN authentication-bypass flaw among seven vulnerabilities fixed in SonicOS firewalls. SecurityWeek said two other vulnerabilities in the update affect the SonicOS management interface and each has a CVSS score of 8.8.

SonicWall’s product security team investigated a report indicating potential exploitation of the vulnerability. The company urged customers to upgrade to the latest release as soon as possible.

CISA encourages organizations to adopt risk-based vulnerability management and prioritize remediation of vulnerabilities in its catalog of flaws exploited in the wild.

What to do now

  1. Upgrade to the latest release as soon as possible to mitigate the associated risks.
  2. Federal agencies must address the vulnerability by November 20 under Binding Operational Directive 26-04.

FAQ

What is CVE-2026-19868?

CISA describes it as a SonicWall SonicOS SSLVPN use-of-single-factor-authentication vulnerability. SecurityWeek said it can bypass SAML authentication.

Which SonicWall devices are affected by CVE-2026-19868?

SecurityWeek said affected devices include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older.

Has CVE-2026-19868 been exploited?

SonicWall investigated a report indicating potential exploitation, while SecurityWeek said the flaw may have been exploited in attacks.

How do I fix CVE-2026-19868?

SecurityWeek said SonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the issue and that no workarounds are available.

Does CVE-2026-19868 affect SAML-enabled SSL VPN?

According to SonicWall, an SSL VPN is exposed only if SAML-based login is enabled.

Sources

  1. CISA Adds One Known Exploited Vulnerability to Catalog, CISAPrimary
  2. Known Exploited Vulnerabilities Catalog | CISA, CISAPrimary
  3. SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins, SecurityWeek
  4. SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks, BleepingComputer
  5. SonicWall, Wikipedia
How we checked this story
ClaimSourceStatus
SecurityWeek said sonicWall patched a SonicOS vulnerability that can bypass SAML authentication and may have been exploited in attacks.SecurityWeekAttributed
SecurityWeek said cVE-2026-19868 affects the SSL VPN component of SonicOS, the operating system that runs on SonicWall firewalls.SecurityWeekAttributed
CISA listed CVE-2026-19868 as a SonicWall SonicOS SSLVPN use-of-single-factor-authentication vulnerability.CISAConfirmed
BleepingComputer said sonicWall included the SSL VPN authentication-bypass flaw among seven vulnerabilities fixed in SonicOS firewalls.BleepingComputerAttributed
SecurityWeek said cVE-2026-19868 has a CVSS score of 7.1.SecurityWeekAttributed
SecurityWeek said the flaw was reported by Ryan Harris of The Electronic Office.SecurityWeekAttributed
SonicWall said its product security team investigated a report indicating potential exploitation of the vulnerability.SonicWall, via SecurityWeekAttributed
SecurityWeek said an SSL VPN is exposed only if SAML-based login is enabled, according to SonicWall.SecurityWeekAttributed
SecurityWeek said affected devices include specified Gen7 and Gen8 SonicWall firewalls running the listed older SonicOS versions.SecurityWeekAttributed
SecurityWeek said sonicOS versions 7.3.4-7013 and 8.2.3-8015 resolve the issue, and no workarounds are available.SecurityWeekAttributed
CISA encourages all organizations to adopt risk-based vulnerability management and prioritize remediation of KEV Catalog vulnerabilities.CISAConfirmed
CISA maintains the KEV catalog as an authoritative source of vulnerabilities exploited in the wild.CISAConfirmed
SonicWall is an American cybersecurity company that sells internet appliances primarily for content control and network security.WikipediaConfirmed
SecurityWeek said two other SonicOS vulnerabilities affecting the management interface each have a CVSS score of 8.8.SecurityWeekAttributed

Could not verify

  • Whether the vulnerability was exploited as a zero-day is not established
  • How many SonicWall devices or organizations were affected is not established
  • Whether the suspected attacks were linked to a specific threat actor is not established
  • Whether attackers obtained access through the vulnerability before patching is not established
cve
See all in Vulns & Patches →
Explore with AI
ChatGPT
Claude
Perplexity
Grok