L4 · Septic Tank BlewSonicWall · SonicOS · SSLVPNsonicos-sslvpn-saml

SonicOS seven-flaw batch includes exploited SSLVPN SAML/MFA bypass

SonicWall fixes seven SonicOS flaws; CISA confirms exploitation of CVE-2026-19868. It bypasses SAML and its MFA using valid alternate-method credentials when SSLVPN SAML login is enabled. Gen7 and Gen8 fixes are 7.3.4-7013 and 8.2.3-8015; the other flaws have distinct prerequisites and impacts.

Disclosed: Nov 6, 2026; Public disclosure date
Severity: CVSS 8.8 × 2; 7 CVEs tracked here
Splash zone: Gen7 SonicOS ≤7.3.3-7015 or Gen8 ≤8.2.2-8015; exploited bypass needs SSLVPN SAML and valid alternate-method credentials.; SonicWall · SonicOS · SSLVPN
In the wild: Yes; CISA lists CVE-2026-19868 in KEV. Exploitation of the other six remains unconfirmed.

What happened

The exploited path requires SSLVPN with SAML login and valid credentials for an alternate method. That path can skip the expected SAML controls, including SAML-enforced MFA. CISA confirms exploitation of CVE-2026-19868. The reviewed records provide no victim count or incident-specific indicators.

The other CVEs cover two management-interface flaws, an SSL-VPN denial of service, two conditional TACACS+ denial-of-service paths and weak password hashing on virtual appliances. The management scores include user interaction. The virtual-appliance issue requires local access and CISA’s assessment includes high privileges. The overflow reports describe denial of service.

SonicWall announced the batch on November 3 and published the individual CVE details on November 6. The linked PSIRT detail page returned no readable text during this check. The vendor support notice and release notes establish the firmware thresholds, while the SonicWall CNA records supply the individual descriptions. CISA ADP supplies the listed CVSS 3.1 scores. This batch concerns SonicOS firewall firmware.

What’s in the bowl

CVE-2026-19868CVSS 7.5

SSLVPN SAML authentication enforcement bypass

Valid credentials for an alternate authentication method can bypass SAML controls, including SAML-enforced MFA, when SAML is enabled for SSLVPN login.

CVE-2026-107155CVSS 8.8

Permissive management cross-domain policy

Under specific conditions, a remote unauthenticated attacker can perform unauthorized management operations; the score includes user interaction.

CVE-2026-107154CVSS 8.8

Management session validation

Under specific conditions, a remote unauthenticated attacker can perform unauthorized management operations; the score includes user interaction.

CVE-2026-82308CVSS 7.5

SSL-VPN pre-authentication heap overflow

A remote unauthenticated attacker may cause application-level denial of service in SSL-VPN. The advisory does not claim code execution.

CVE-2026-77708CVSS 5.9

TACACS+ pre-authentication stack overflow

Under specific conditions, a remote unauthenticated attacker may cause application-level denial of service in the TACACS+ authentication client.

CVE-2026-77709CVSS 5.9

TACACS+ pre-authentication heap overflow

Under specific conditions, a remote unauthenticated attacker may cause application-level denial of service in the TACACS+ authentication client.

CVE-2026-19703CVSS 5.1

Weak platform password hashing

Existing high-privilege local access to a virtual appliance may expose a platform credential limited to a subset of platform settings.

Fixed versions

Product	Safe from	Note
SonicOS Gen7 hardware and NSv	`7.3.4-7013`	Vendor fixed build
SonicOS Gen8 hardware and NSv	`8.2.3-8015`	Vendor fixed build

Crime-scene timeline

Nov 6, 18:40–19:06 UTC
SonicWall discloses the seven CVEs
The CNA records identify the same advisory batch. Their public disclosure timestamps span 18:40 to 19:06 UTC.
Nov 6, 2026
CISA adds the SSLVPN bypass to KEV
The catalog lists November 20 as the federal remediation due date. Ransomware use is unknown.

Who said what

We list each claim and who made it. Primary sources (the vendor, the researcher, the registry) are marked. Where reports disagree, we grade by the worst credible case.

SonicWall support noticePrimaryNovember 3 advance notice, updated November 6. The table gives the exact affected and fixed builds for physical and virtual Gen7 and Gen8 firewalls.
SonicOS Gen7 7.3.4-7015 release notesPrimaryDocuments the later Gen7 build and the NSv upgrade constraint from 7.0.1.
SonicOS Gen8 8.2.3-8015 release notesPrimaryLists the hardware and NSv firmware and confirms the SSLVPN alternate-authentication fix.
SonicWall CNA record for CVE-2026-19868PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-107155PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-107154PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-82308PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-77708PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-77709PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
SonicWall CNA record for CVE-2026-19703PrimarySonicWall identifies this issue in SNWLID-2026-0014. The score shown is CISA ADP CVSS 3.1.
CISA Known Exploited Vulnerabilities catalogPrimaryConfirms known exploitation of CVE-2026-19868 and gives the November 20 federal due date.

Wipe guide

The wipe checklist

0 of 3 sheets used

Install the correct platform firmwareCheck the hardware or NSv generation and exact running build in the administrative interface. The vendor lists Gen7 7.3.4-7013 as the minimum fix and 7.3.4-7015 as a later build. Use Gen8 8.2.3-8015 or a later supported build. Back up the configuration, check the model-specific upgrade path and test VPN connectivity after upgrading. Gen7 NSv on 7.0.1 requires a fresh install when moving to 7.1.x or later.
Review SSLVPN authentication and sessionsCheck whether SAML is enabled for SSLVPN login and which alternate methods and identities remain usable. Preserve VPN authentication, identity-provider and firewall logs. Correlate successful VPN sessions with expected SAML and MFA events. Investigate unusual users, source addresses and times, then revoke affected sessions and rotate exposed credentials from a clean admin system. Missing SAML events alone are insufficient evidence.
Check management, TACACS+ and virtual-appliance exposureLimit management and unnecessary VPN reachability while arranging the upgrade. Check TACACS+ dependencies and privileged NSv access separately. For Gen6 and older end-of-support firewalls, plan migration with SonicWall. The Gen7 and Gen8 builds do not apply to those devices.