{"id":4120,"date":"2026-11-10T09:50:32","date_gmt":"2026-11-10T17:50:32","guid":{"rendered":"https:\/\/cyber.mag212.com\/?p=4120"},"modified":"2026-11-10T09:50:32","modified_gmt":"2026-11-10T17:50:32","slug":"sonicwall-cve-2026-19868-ssl-vpn-saml-mfa-bypass-fixed-versions","status":"publish","type":"post","link":"https:\/\/cyber.mag212.com\/fr\/sonicwall-cve-2026-19868-ssl-vpn-saml-mfa-bypass-fixed-versions\/","title":{"rendered":"SonicWall CVE-2026-19868 Update: SSL-VPNs That Skip SAML MFA, Fixed SonicOS Builds and the 20 Nov Deadline"},"content":{"rendered":"

If your SonicWall SSL-VPN sends users through a SAML identity provider for MFA, a user holding credentials for a different login method can skip that MFA entirely. SonicWall has fixed the flaw, CVE-2026-19868, in SonicOS 7.3.4-7013 and 8.2.3-8015, there is no workaround, and CISA has listed it as exploited with a federal deadline of 20 November. We first reported the exploitation on 7 November (MAG212 CYBER Daily, 7 November<\/a>); this update sets out exactly which devices are exposed, what to upgrade to and what else is in the same advisory.<\/p>\n\n\n\n

CVE<\/strong><\/td>CVE-2026-19868, SonicOS SSL-VPN \u201cuse of single-factor authentication\u201d (CWE-308)<\/td><\/tr>
Affect\u00e9<\/strong><\/td>Gen7 TZ\/NSa\/NSsp\/NSv on SonicOS 7.3.3-7015 or older; Gen8 TZ\/NSa\/NSv on 8.2.2-8015 or older<\/td><\/tr>
Exposure condition<\/strong><\/td>Only when SSL-VPN is configured for SAML authentication<\/strong><\/td><\/tr>
Fix\u00e9 dans<\/strong><\/td>SonicOS 7.3.4-7013<\/strong> (Gen7) and 8.2.3-8015<\/strong> (Gen8)<\/td><\/tr>
Workaround<\/strong><\/td>Aucun<\/td><\/tr>
Exploit\u00e9<\/strong><\/td>SonicWall cites a report of potential exploitation; CISA KEV since 6 Nov<\/td><\/tr>
Deadline<\/strong><\/td>Federal KEV due date 20 Nov 2026<\/strong><\/td><\/tr>
CVSS<\/strong><\/td>7.1 (SonicWall); 7.5 from CISA\u2019s scoring, reported second-hand<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

What has changed since our first report<\/h2>\n\n\n\n

CISA added CVE-2026-19868 to KEV on 6 November with a 20 November due date (CISA KEV<\/a>), and The Hacker News covered CISA\u2019s flagging of it on 9 November (Les actualit\u00e9s des hackers<\/a>). Trade-press reporting has since filled in the details of SonicWall advisory SNWLID-2026-0014. SonicWall says it \u201cinvestigated a report of potential exploitation\u201d of the flaw but has not described the attacks (BleepingComputer<\/a>). The issue was reported by Ryan Harris of The Electronic Office, and SonicWall is urging customers to upgrade as soon as possible.<\/p>\n\n\n\n

Qui est concern\u00e9 ?<\/h2>\n\n\n\n

According to SecurityWeek and BleepingComputer, the vulnerable builds are Gen7 TZ, NSa, NSsp and NSv appliances on SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv appliances on 8.2.2-8015 or older. A device is exposed to this particular flaw only if its SSL-VPN is configured for SAML authentication (Semaine de la s\u00e9curit\u00e9<\/a>; BleepingComputer<\/a>).<\/p>\n\n\n\n

The same advisory fixes six more SonicOS issues whose exploitation status is not stated: two management-interface flaws rated 8.8 (CVE-2026-107155 and CVE-2026-107154), a pre-authentication SSL-VPN heap overflow that causes denial of service (CVE-2026-82308, 7.5), two TACACS+ issues rated 5.9 (CVE-2026-77708 and CVE-2026-77709) and weak password hashing on virtual appliances (CVE-2026-19703, 5.2). Those details come from a secondary digest (Oflight<\/a>).<\/p>\n\n\n\n

Analyse CYBER MAG212\u00a0:<\/strong> MSPs and schools that front SonicWall SSL-VPN with Entra ID, Google or another SAML provider are the group directly at risk. Fleets that don\u2019t use SAML should still upgrade, because of the two 8.8-rated management-interface flaws.<\/p>\n\n\n\n

Comment fonctionne l'attaque<\/h2>\n\n\n\n

As reported, a user who holds valid credentials for an alternate<\/em> authentication method on the appliance can get past the SAML controls on SSL-VPN logins, including MFA that the SAML provider would normally enforce (Semaine de la s\u00e9curit\u00e9<\/a>). In other words, the second door into the same portal does not check what the first door checks.<\/p>\n\n\n\n

\"Diagram
Intended SAML-plus-MFA login versus the reported alternate-method bypass. Conceptual, based on reporting; exact login flows vary by configuration. Diagram: MAG212 CYBER<\/figcaption><\/figure>\n\n\n\n

Much is still unknown: who exploited the flaw, how widely, where attackers obtained alternate-method credentials, and any indicators of compromise. None were published in the sources we reviewed, and no source links this flaw to ransomware. SSL-VPN is nonetheless one of the most common initial-access routes, which is why the fix should not wait.<\/p>\n\n\n\n

Que rechercher<\/h2>\n\n\n\n

If SAML SSL-VPN is enabled, review recent VPN sessions that authenticated through a method other than SAML, and check what those sessions reached. SonicWall\u2019s own detection guidance and the GUI path for confirming the SAML configuration are in its PSIRT advisory, which we could not retrieve at press time (SonicWall PSIRT SNWLID-2026-0014<\/a>); read it before you act. We are not reproducing menu paths or commands we could not verify.<\/p>\n\n\n\n

Investigate, contain and fix<\/h2>\n\n\n\n
    \n
  1. Inventory every SonicWall firewall on Gen7 7.3.3-7015 or older and Gen8 8.2.2-8015 or older, and flag those with SAML SSL-VPN enabled.<\/li>\n\n\n
  2. Upgrade those first to 7.3.4-7013 or 8.2.3-8015, then the rest of the fleet. There is no workaround.<\/li>\n\n\n
  3. Restrict the management interface to trusted networks, given the 8.8-rated management flaws in the same advisory.<\/li>\n\n\n
  4. Where alternate-method VPN logins look suspicious, reset those credentials and review what the sessions accessed (MAG212 CYBER analysis).<\/li>\n\n<\/ol>\n\n\n\n

    How to prioritise a large fleet<\/h2>\n\n\n\n

    Analyse CYBER MAG212\u00a0:<\/strong> for MSPs and multi-site schools with dozens of appliances, a simple order of work keeps the riskiest devices first:<\/p>\n\n\n\n

    Priorit\u00e9<\/th>Device profile<\/th>Action<\/th><\/tr><\/thead>
    1<\/td>SAML SSL-VPN enabled and management interface reachable from the internet<\/td>Upgrade today; restrict management access immediately<\/td><\/tr>
    2<\/td>SAML SSL-VPN enabled, management restricted<\/td>Upgrade today; review alternate-method logins since early November<\/td><\/tr>
    3<\/td>SSL-VPN without SAML<\/td>Upgrade this week for the DoS and management-interface fixes<\/td><\/tr>
    4<\/td>No SSL-VPN, management restricted<\/td>Upgrade in the next maintenance window<\/td><\/tr><\/tbody><\/table><\/figure>\n\n\n\n

    Whatever the tier, note that the federal KEV deadline of 20 November is a ceiling, not a target. SSL-VPN appliances sit at the edge, and edge flaws are typically exploited faster once details circulate.<\/p>\n\n\n\n

    How to confirm you\u2019re clean<\/h2>\n\n\n\n