{"id":12483,"date":"2026-11-06T19:32:00","date_gmt":"2026-11-07T01:32:00","guid":{"rendered":"https:\/\/beaconlab.us\/publicacion\/alert-2026-147-active-exploitation-in-sonicwall-sonicos-sslvpn\/"},"modified":"2026-11-06T19:34:46","modified_gmt":"2026-11-07T01:34:46","slug":"alert-2026-147-active-exploitation-of-sonicwall-sonicos-sslvpn","status":"publish","type":"publicacion","link":"https:\/\/beaconlab.us\/en\/publication\/alert-2026-147-active-exploitation-of-sonicwall-sonicos-sslvpn\/","title":{"rendered":"Alert 2026-147 Active exploitation of SonicWall SonicOS SSLVPN"},"content":{"rendered":"\n

Affected product(s):\u00a0<\/h2>\n\n
Product<\/strong><\/td>Affected versions<\/strong><\/td><\/tr>
SonicOS Gen7 \u2014 TZ, NSa, NSsp, and NSv<\/strong><\/td>7.3.3-7015 and earlier<\/td><\/tr>
SonicOS Gen8 \u2014 TZ, NSa, and NSv<\/strong><\/td>8.2.2-8015 and earlier<\/td><\/tr><\/tbody><\/table><\/figure>\n\n

This only applies if SAML is enabled for SSLVPN logins; includes NSv on ESX, KVM, Hyper-V, AWS, and Azure.<\/p>\n\n

Description<\/h2>\n\n

An authentication implementation vulnerability has been disclosed in the SonicWall SonicOS SSLVPN service, identified as CVE-2026-19868 (CWE-308, use of single-factor authentication). The vendor assigns it a CVSS score of 7.1, High. SonicOS is the operating system for SonicWall firewalls, and its SSLVPN service enables remote access to the internal network.<\/p>\n\n

The flaw only affects systems where SAML is enabled for SSLVPN logins. A user with valid credentials for an alternative authentication method can bypass the SAML controls and the MFA enforced by SAML. The vendor does not specify which alternative methods qualify. It cannot be used for remote code execution, does not bypass authentication without credentials, and does not grant firewall administrative access.<\/p>\n\n

The risk is that MFA via SAML, which typically mitigates password theft, no longer protects VPN access if the attacker has valid credentials for another authentication method.<\/p>\n\n

The vendor stated that it investigated a report of possible exploitation and urges users to update as soon as possible. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog on Nov 6, 2026, based on evidence of active exploitation. No public proof of concept was identified in the sources reviewed, and EPSS is not yet available. There is no public attribution to threat actors or confirmation of use in ransomware campaigns.<\/p>\n\n

Mitigation<\/h2>\n\n

The vendor does not provide a temporary workaround. It is recommended to prioritize updating firewalls with an exposed SSLVPN service and SAML enabled for SSLVPN logins. While the patch is being applied, the following general measures are recommended:<\/p>\n\n