SonicWall Patches Seven Firewall Flaws as CISA Confirms SAML Bypass Under Active Exploitation
SonicWall has updated its advisory SNWLID-2026-0014 covering seven vulnerabilities in SonicOS, the operating system running on its Gen 7 and Gen 8 firewalls. Five of the seven can be reached by an unauthenticated remote attacker. The full set comprises CVE-2026-107155, a permissive cross-domain policy flaw rated CVSS 8.8; CVE-2026-107154, a session validation flaw also rated 8.8; CVE-2026-82308, a pre-authentication heap buffer overflow in SSL-VPN rated 7.5; CVE-2026-19868, an authentication enforcement flaw via alternate authentication methods rated 7.1; CVE-2026-77708 and CVE-2026-77709, pre-authentication stack and heap buffer overflows in TACACS+ both rated 5.9; and CVE-2026-19703, weak password hashing rated 5.2. SonicWall describes exploitation of CVE-2026-19868 as potential, while CISA added that CVE to its Known Exploited Vulnerabilities catalogue on 6 November 2026, treating exploitation as active. Fixes shipped alongside the disclosure, and a workaround was published for CVE-2026-19868 only. Organisations running Gen 7 or Gen 8 firewalls with SSL VPN exposed to the internet are in scope; the earlier SonicWall issues reported in July and September affected the separate SMA 1000 remote access appliances, not SonicOS.
The flaw under exploitation, CVE-2026-19868, breaks the assumption that every SSL VPN login passes through the identity provider. An attacker who already holds valid credentials for an alternate authentication method configured on the firewall, such as a local account or an LDAP, RADIUS or TACACS+ directory, can use that path instead of SAML and therefore never encounters the multifactor prompt that rides on the SAML flow. No attack against the MFA mechanism itself is required, which is why the vendor workaround centres on disabling or deleting any active LDAP, RADIUS and TACACS+ authentication servers configured on the appliance. The other six issues are of mixed weight: the three pre-authentication buffer overflows in SSL-VPN and TACACS+ have a stated impact of denial of service, knocking the VPN offline rather than opening it, and the two CVSS 8.8 management interface flaws are only reachable under specific conditions. Analysts reviewing the set have noted that the weaknesses sit at different stages of the authentication process and could be chained, with the weak password hashing in CVE-2026-19703 of most use to an attacker who already has a foothold and wants to recover credentials. The session validation issue, CVE-2026-107154, reportedly relies on IP address checks, which offer limited assurance that a user is who they claim to be. SonicWall has not published a detailed exploitation chain for the activity it has seen.
Internet-facing VPN appliances remain one of the most heavily targeted classes of edge infrastructure, and an authentication bypass on one collapses the control that most organisations rely on to keep stolen passwords from reaching the internal network. The particular danger in this advisory is environments where SAML was layered on top of older directory logins that were left live, because a single stolen directory password then reaches remote access directly. CISA's KEV listing on 6 November 2026 makes exploitation of CVE-2026-19868 confirmed rather than theoretical, although FIRST EPSS currently scores it at a 0.5% probability of exploitation in the next 30 days. The remaining six carry similarly low EPSS probabilities over the same window: 0.8% for CVE-2026-107155, 0.7% each for CVE-2026-107154, CVE-2026-77708 and CVE-2026-77709, 0.6% for CVE-2026-82308 and 0.2% for CVE-2026-19703, and none of the six is known to be exploited. Wider context sharpens the concern: of SonicWall's twenty entries in the CISA exploited list, thirteen carry the flag for known ransomware use, the highest share among eight edge vendors tracked. The recurrence of authentication defects across different SonicWall product lines has also raised questions among analysts about secure development practice at the vendor rather than a single faulty product.
Attack Surface
Remote Access Service, Infrastructure, System Management Service
Tactics
Initial Access, Defense Evasion, Credential Access, Impact
Techniques
- T1190 – Exploit Public-Facing Application
- T1133 – External Remote Services
- T1556 – Modify Authentication Process
- T1110.002 – Password Cracking
- T1499 – Endpoint Denial of Service
SuperPRO's Threat Countermeasures Procedures
- Apply the SonicOS firmware fixes published with SonicWall advisory SNWLID-2026-0014 across all Gen 7 and Gen 8 firewalls, prioritising appliances with SSL VPN published to the WAN interface, since all seven CVEs including the exploited CVE-2026-19868 are addressed in that release.
- Where firmware cannot be loaded immediately, apply SonicWall's only published workaround for CVE-2026-19868: disable or delete every active LDAP, RADIUS and TACACS+ authentication server configured on the firewall so SAML remains the sole SSL VPN authentication path.
- Review SonicOS auth and SSL VPN logs for user sessions that completed through a local, LDAP, RADIUS or TACACS+ account rather than the SAML identity provider, especially since 6 November 2026 when CVE-2026-19868 entered the CISA KEV catalogue, and treat such logins as suspected SAML and MFA bypass.
- Restrict the SonicOS management interface to an internal management VLAN or an explicit list of administrative source address objects, removing WAN access, as the two CVSS 8.8 issues CVE-2026-107155 (permissive cross-domain policy) and CVE-2026-107154 (session validation) are management interface flaws.
- Stop treating client IP address as an authentication signal on SSL VPN policies, since CVE-2026-107154 relies on IP-based session validation; require SAML plus identity provider MFA on every VPN user group and remove any group still permitted password-only access.
- Rotate passwords for all local firewall administrator and user accounts and delete dormant local accounts, because CVE-2026-19703 is a weak password hashing flaw that favours an attacker who already holds a foothold on the appliance.
- Alert on repeated SSL VPN and TACACS+ service crashes or unexpected appliance restarts as the signature of denial-of-service exploitation of CVE-2026-82308, CVE-2026-77708 and CVE-2026-77709, and remove TACACS+ authentication server entries on firewalls that do not use them.
