SonicWall Patches Exploited SonicOS Flaw That Weakens SAML VPN Logins

SonicWall warned customers that the flaw, tracked as CVE-2026-19868 and rated 7.1 on CVSS, may have been exploited in attacks. It is one of seven vulnerabilities described in an advisory published on 6 November. According to the vendor, the SSL VPN is exposed only if SAML-based login is enabled. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA). CISA added the flaw to its Known Exploited Vulnerabilities catalog on the same day and set 20 November as the deadline for federal agencies to address it under Binding Operational Directive 26-04.

Affected devices include Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. SonicOS 7.3.4-7013 and 8.2.3-8015 resolve the issue, and there are no workarounds. Neither SonicWall nor CISA has shared details about the suspected attacks, and it is unclear whether the flaw was exploited as a zero-day. SonicWall's advisory does not mark the other six flaws as exploited.

Why it matters Organizations that use SAML-based login on SonicOS SSL VPN should check whether their firewalls fall within the affected versions and upgrade to the fixed releases, since no workaround is available. Because the flaw can bypass SAML-enforced MFA, security teams should also review VPN access logs for logins that did not follow the expected authentication path. Investigators should keep in mind that the vendor and CISA have not described the suspected attacks, so the scope of any exploitation remains unknown.