If your company’s VPN is a SonicWall firewall using SAML sign-in, it needs patching now. SonicWall says CVE-2026-19868, a flaw in SonicOS SSLVPN, can let someone get in without clearing the SAML check, and that includes any multi-factor prompt enforced through it.
SonicWall adds that it is looking at a report that the bug may already be abused in the wild. The company has not said who is behind it, who was hit or when, so a large campaign is not established. The flaw scores 7.1 on the CVSS scale.
The bug is not open to everyone. A firewall is at risk only when its VPN logs people in through SAML, and the intruder first needs a working account that uses another login route on that box. The fault lies in how the firewall enforces authentication, not in SAML as a standard. Ryan Harris of The Electronic Office found and reported it.
It is one of seven issues in SonicWall’s advisory of 6 November. The other six:
| CVE | Score | Where | Issue |
|---|---|---|---|
| CVE-2026-107155 | 8.8 | Management interface | Overly permissive cross-domain policy |
| CVE-2026-107154 | 8.8 | Management interface | Session validation |
| CVE-2026-82308 | 7.5 | SSLVPN | Heap overflow before login |
| CVE-2026-77708 | 5.9 | TACACS+ client | Denial of service |
| CVE-2026-77709 | 5.9 | TACACS+ client | Denial of service |
| CVE-2026-19703 | 5.2 | Virtual appliances | Exposes a limited platform credential to someone with local access |
The two 8.8 management flaws need a user to interact, according to the advisory’s scoring vectors.
Which build you need depends on the generation of firewall:
| Appliance | Vulnerable up to | Fixed in |
|---|---|---|
| Gen7 hardware and NSv | SonicOS 7.3.3-7015 | 7.3.4-7013 and later |
| Gen8 hardware and NSv | SonicOS 8.2.2-8015 | 8.2.3-8015 and later |
No workaround is listed, so upgrading is the only fix. While you do it, review recent VPN logins for sessions that never showed a SAML prompt.
