SonicWall Patches SonicOS Flaw That Bypasses SAML and MFA

SonicWall has released security updates to address a high-severity vulnerability in its SonicOS operating system that enables attackers to bypass SAML-enforced multi-factor authentication (MFA).

The flaw, tracked as CVE-2026-19868, affects the SSL VPN component of the SonicOS operating system. It allows an attacker holding valid credentials for an alternative authentication method to circumvent SAML authentication controls, potentially gaining unauthorised access even when MFA is enabled.

The vulnerability has received a CVSS score of 7.1, classifying it as high severity. The CISA Known Exploited Vulnerabilities (KEV) catalogue added the flaw on 7 November 2026, following reports of potential exploitation. Under Binding Operational Directive 26-04, US federal agencies are required to remediate the issue by 20 November.

Affected Systems and Remediation

The vulnerability impacts several generations of SonicWall firewalls. Affected devices include:

• Gen7 TZ, NSa, NSsp, and NSv firewalls running SonicOS 7.3.3-7015 or older.
• Gen8 TZ, NSa, and NSv firewalls running SonicOS 8.2.2-8015 or older.

SonicWall has stated that there are no available workarounds for this flaw. Impacted organisations are urged to upgrade to SonicOS versions 7.3.4-7013 or 8.2.3-8015 immediately to mitigate the risk.

Broader Security Advisory

The patch for CVE-2026-19868 is part of a larger security advisory covering six additional vulnerabilities. Two of these flaws carry a higher CVSS score of 8.8 and affect the SonicOS management interface. One involves a permissive cross-domain policy issue, while the other is a session validation bug that could allow remote attackers to perform unauthorised actions without logging in.

Other identified issues include three pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client, which could be leveraged to launch denial-of-service (DoS) attacks. Additionally, a weak password hashing issue was identified in virtual appliances, which could allow an attacker with high-privileged local access to obtain platform credentials.