I’M UNDER A CYBER ATTACK

Alert

Logo de SonicWall

Alert 2026-147 Active exploitation of SonicWall SonicOS SSLVPN

Affected product(s): 

ProductAffected versions
SonicOS Gen7 — TZ, NSa, NSsp, and NSv7.3.3-7015 and earlier
SonicOS Gen8 — TZ, NSa, and NSv8.2.2-8015 and earlier

This only applies if SAML is enabled for SSLVPN logins; includes NSv on ESX, KVM, Hyper-V, AWS, and Azure.

Description

An authentication implementation vulnerability has been disclosed in the SonicWall SonicOS SSLVPN service, identified as CVE-2026-19868 (CWE-308, use of single-factor authentication). The vendor assigns it a CVSS score of 7.1, High. SonicOS is the operating system for SonicWall firewalls, and its SSLVPN service enables remote access to the internal network.

The flaw only affects systems where SAML is enabled for SSLVPN logins. A user with valid credentials for an alternative authentication method can bypass the SAML controls and the MFA enforced by SAML. The vendor does not specify which alternative methods qualify. It cannot be used for remote code execution, does not bypass authentication without credentials, and does not grant firewall administrative access.

The risk is that MFA via SAML, which typically mitigates password theft, no longer protects VPN access if the attacker has valid credentials for another authentication method.

The vendor stated that it investigated a report of possible exploitation and urges users to update as soon as possible. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog on Nov 6, 2026, based on evidence of active exploitation. No public proof of concept was identified in the sources reviewed, and EPSS is not yet available. There is no public attribution to threat actors or confirmation of use in ransomware campaigns.

Mitigation

The vendor does not provide a temporary workaround. It is recommended to prioritize updating firewalls with an exposed SSLVPN service and SAML enabled for SSLVPN logins. While the patch is being applied, the following general measures are recommended:

  • Review which accounts can authenticate to SSLVPN using methods other than SAML and restrict those methods where possible. This does not replace updating or constitute an official solution to the flaw.
  • Review recent SSLVPN logins for successful access attempts that did not pass through SAML/MFA, unusual IP addresses or locations, and access by accounts that normally use SAML.
  • If there are indicators, treat this as a possible credential compromise: rotate passwords, revoke sessions, and investigate subsequent activity on the internal network.

The vendor and CISA did not publish official indicators of compromise, hashes, IP addresses, log names, or vulnerability-specific signatures for this vulnerability. Reviewing access activity is a general recommendation, not conclusive detection.

Solution

Update SonicOS to the following fixed versions or later:

  • Gen7: 7.3.4-7013 or later.
  • Gen8: 8.2.3-8015 or later.

Verify the exact installed build; checking only 7.3.4 or 8.2.3 is not sufficient. The update fixes the flaw, but it does not undo any access already obtained.

For information on how to update, visit the following link:

https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

Additional information: