SonicWall patches seven flaws as CISA flags exploited SAML bypass

SonicWall released security updates on November 6, 2026, fixing seven vulnerabilities in its SonicOS firewall software, including an SSL-VPN authentication bypass tracked as CVE-2026-19868 that has already been exploited in attacks, according to bleepingcomputer.com.

The SAML flaw carries a CVSS severity score of 7.1 and affects only SonicOS SSL-VPN services configured to use SAML authentication. An attacker holding valid credentials for an alternate authentication method can use it to bypass SAML authentication controls, potentially including SAML-enforced MFA.

CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, and ordered federal civilian executive branch agencies to secure affected systems by November 20, 2026.

The remaining six flaws include two management interface issues rated 8.8 severity. The affected builds are SonicOS Gen7 versions 7.3.3-7015 and earlier and Gen8 versions 8.2.2-8015 and earlier; SonicWall fixed them in versions 7.3.4-7013 and 8.2.3-8015 and says no workarounds are available.

Ryan Harris of The Electronic Office discovered and reported the SAML vulnerability.

Earlier SonicWall attacks

The patch follows a run of attacks on the vendor's products. In October, researchers detected exploitation attempts against CVE-2026-102255, a maximum-severity flaw in SonicWall's SMA1000 secure remote access appliances. September attacks chained two SMA1000 zero-days to achieve remote code execution, and July attacks exploited two other zero-days to deploy malware on vulnerable SonicWall appliances.