SonicWall has pushed out an urgent advisory covering seven vulnerabilities in SonicOS, its firewall and SSLVPN operating system, after a researcher flagged signs that one of the flaws may already be under attack in the wild. The most pressing issue, tracked as CVE-2026-19868 and rated 7.1 on the CVSS scale, lets an attacker sidestep the multi-factor authentication checks that SAML single sign-on is supposed to enforce on SSLVPN logins.

A narrow but dangerous gap in SAML enforcement

The flaw only matters to organizations that have SAML enabled for their SSLVPN sign-ins, a setup many enterprises use to centralize authentication through an identity provider and layer MFA on top of it. Under the right conditions, an attacker who already holds valid credentials for an alternate login method on the appliance can use them to get past the SAML and MFA gate entirely, landing inside the VPN tunnel without ever satisfying the additional verification administrators believed was mandatory.

That distinction matters. This is not a wide-open bypass that lets anyone walk in with no credentials at all. It requires an attacker to already possess some valid account access. But it does mean that the extra layer of protection security teams rely on to catch stolen or guessed passwords, SAML-enforced MFA, simply does not apply in the affected configuration. For a remote-access gateway sitting at the edge of a corporate network, that gap is exactly the kind of thing ransomware affiliates and initial-access brokers look for.

The vulnerability was reported to SonicWall by Ryan Harris of The Electronic Office. In its advisory, published November 6, the vendor said it had investigated a report indicating potential exploitation and is urging customers to patch immediately. Notably, SonicWall has not disclosed who may be behind any activity, how many organizations might be affected, or over what timeframe. The company’s language is deliberately cautious, a warning sign worth acting on rather than a confirmed mass-exploitation event.

Six more flaws in the same advisory

CVE-2026-19868 is not the only issue in the bundle. Two vulnerabilities affecting SonicOS’s management interface, CVE-2026-107155 and CVE-2026-107154, both carry a CVSS score of 8.8, the highest in the advisory. They stem from a permissive cross-domain policy and a session-validation weakness respectively, and could let an attacker perform unauthorized actions, though both require some form of user interaction to trigger.

• CVE-2026-82308 (CVSS 7.5) – a pre-authentication heap buffer overflow in SSLVPN, meaning it could theoretically be exploited before a user ever logs in.
• CVE-2026-77708 and CVE-2026-77709 (CVSS 5.9 each) – weaknesses in the TACACS+ authentication client that could trigger application-level denial of service.
• CVE-2026-19703 (CVSS 5.2) – a lower-severity issue that could expose a limited platform credential on virtual appliances to someone who already has local access.

Taken together, the advisory touches both remote-access authentication and the administrative console, two of the most attractive targets on any security appliance.

Who is affected, and what to do

SonicWall says the flaws affect Gen7 hardware and NSv virtual appliances running SonicOS 7.3.3-7015 or earlier, and Gen8 hardware and NSv appliances running 8.2.2-8015 or earlier. Fixes are available in SonicOS 7.3.4-7013 and later for Gen7 devices, and 8.2.3-8015 and later for Gen8 devices. No workaround has been published for any of the seven issues, which makes patching the only real mitigation.

It’s worth separating this disclosure from SonicWall’s history with SSLVPN authentication bypasses. An earlier flaw, CVE-2024-53704, involved session hijacking and received considerable attention after being tied to ransomware intrusions. That vulnerability is unrelated to CVE-2026-19868, and its exploitation pattern should not be assumed to apply here. Still, SonicWall’s SSLVPN stack has repeatedly drawn attacker interest, and security teams running these appliances should treat remote-access gateways as a standing priority rather than a set-and-forget piece of infrastructure.

Recommended actions

• Identify every SonicWall Gen7 and Gen8 appliance in your environment and confirm its current firmware version.
• Apply the fixed releases (7.3.4-7013+ for Gen7, 8.2.3-8015+ for Gen8) as soon as a maintenance window allows.
• If SAML is enabled for SSLVPN, review authentication logs for sign-ins that used an alternate method shortly before establishing a session, a possible indicator of attempted bypass.
• Rotate credentials for any accounts with alternate authentication methods configured on affected appliances as a precaution.
• Monitor SonicWall’s advisory page for updates, since the vendor may release further detail as its investigation continues.

Given the uncertainty around active exploitation, organizations that can’t patch immediately should at minimum tighten monitoring on SSLVPN login activity and restrict SSLVPN access to only the users and networks that genuinely need it.