PolicyCortex
Request Access
Summary
  • A valid alternate login could skip SAML controls on the SSLVPN service.
  • The skip could also bypass SAML enforced multi-factor authentication.
  • CISA added the flaw to KEV on November 6, 2026, with a November 20 deadline.
  • Update Gen7 to 7.3.4-7013 or Gen8 to 8.2.3-8015, then test the login path.

SonicWall fixed a login flaw in its firewall software on November 6, 2026. The flaw sits in the Secure Sockets Layer virtual private network (SSLVPN) service. It lets a user with valid credentials for another login method skip Security Assertion Markup Language (SAML) controls. That skip can also bypass SAML enforced multi-factor authentication (MFA). The Cybersecurity and Infrastructure Security Agency added the flaw to its Known Exploited Vulnerabilities catalog the same day.

The flaw

The record is CVE-2026-19868. Common Vulnerabilities and Exposures (CVE) is the public record system for flaws. SonicWall scores the flaw 7.1 on the Common Vulnerability Scoring System (CVSS) version 3.1. The vector is CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:C/C:H/I:L/A:N. The weakness is CWE-308, use of single-factor authentication. CWE means Common Weakness Enumeration. The Cybersecurity and Infrastructure Security Agency (CISA) runs the Known Exploited Vulnerabilities (KEV) catalog.

Only firewalls with SAML enabled for SSLVPN logins are affected. The flaw affects Gen7 firewalls on SonicOS 7.3.3-7015 and earlier. It also affects Gen8 firewalls on SonicOS 8.2.2-8015 and earlier. The fix is SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. SonicWall lists no workaround. The firmware update is the only fix.

What attackers could do

A user who holds valid credentials for an alternate login method could reach the SSLVPN service. The SAML step would not run. The multi-factor check tied to SAML would not run either. The attacker would land inside the network with a session the team believed was protected. SonicWall investigated a report that pointed to potential exploitation. The company urged customers to upgrade at once. It published no technical detail on the reported attacks.

The KEV deadline

CISA added the flaw to KEV on November 6, 2026. The entry sets a fix date of November 20, 2026. That date binds federal civilian agencies under Binding Operational Directive (BOD) 26-04. The entry lists ransomware use as Unknown. The deadline is short because exploitation was reported. Private teams should treat November 20 as their own target date too.

Six more flaws in the same release

The same advisory fixes six more flaws. Two flaws in the management interface score 8.8. They let unauthenticated attackers perform unauthorized operations in specific conditions. The release also covers pre-authentication buffer overflows in SSLVPN. Teams should install the full release, not only the SAML fix.

What to do now

First, list every SonicWall firewall. Record its generation, its SonicOS version, and whether SAML is enabled for SSLVPN logins. Second, update each affected firewall to 7.3.4-7013 or 8.2.3-8015. Third, test the login path after the update. Try an alternate login method against the SSLVPN service. Confirm the SAML step now runs. Confirm the multi-factor check now runs. Fourth, review SSLVPN login logs for alternate method logins that skipped SAML. Fifth, rotate credentials tied to any session that skipped the check.

The governance lesson

The flaw came from a fallback path. An alternate login method could reach the service without the SAML step. The team believed SAML protected every login. The firewall did not enforce that belief. That is the lesson for every team. A login control must cover every path into the system, not only the main one. Evidence must show the check ran on each path. A policy that names SAML is not proof. A test that shows the SAML step running is proof.

Sources

Next step

Update every affected firewall to the fixed SonicOS build. Then test that the SAML step and the multi-factor check run on every login path.

Questions on this record
Which firewalls are affected?
Gen7 firewalls on SonicOS 7.3.3-7015 and earlier, and Gen8 firewalls on 8.2.2-8015 and earlier, with SAML enabled for SSLVPN logins.
Was the flaw exploited?
SonicWall investigated a report of potential exploitation. CISA added the flaw to the Known Exploited Vulnerabilities catalog on November 6, 2026.
Is there a workaround?
No. SonicWall lists no workaround. The firmware update is the fix.

Related records

Guides and articles describe the work. The evidence that work produces is described in three proof pages and one architecture page.

proof.state
Proof of State. What the environment was, as of a date someone else picks: point-in-time records, content hashed and chained.
proof.change
Proof of Change. Who or what altered the environment, under what authority, with before and after state hashes.
proof.agency
Proof of Agency. What a machine was permitted to do before it acted, what it did, and what would have stopped it.
architecture
Architecture. How the chain is built and where it lives: inside your tenant, with no egress of evidence.

Further reading in this register

  1. SolarWinds Dameware Command Injection Scores 9.9SolarWinds fixed a Dameware command injection flaw scored 9.9. An authenticated user could run commands on the remotely controlled host. Update to 2026.3.1.5 min
  2. FBI and CISA Warn That Attackers Are Targeting Refrigeration ControllersA joint advisory dated November 5, 2026 warns that attackers target refrigeration controllers in grocery and cold storage sites. The fix starts with removing internet exposure and changing default passwords.5 min
  3. GPUStack Auth Bypass Gave Attackers Admin Access With No LoginGPUStack fixed an auth bypass scored 9.8. Attackers had already used it in the wild. Update to 2.2.2 or later.5 min

Verify the record this entry describes.

Request AccessBook a call
Published
Last updated
Unchanged since publication
Author
Leonard Esere