The flaw, CVE-2026-19868, lets an attacker with valid credentials for an alternate authentication method bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication. It has a severity score of 7.1 and affects only SSL-VPN services configured to use SAML. SonicWall said it had investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog, ordering federal agencies to fix it by November 20.
The update fixes six more vulnerabilities, including two 8.8-severity management interface flaws that let unauthenticated attackers perform unauthorized operations under certain conditions, pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that can cause denial of service, and weak password hashing on virtual appliances.
What to do: affected versions are SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier. The fixes are in versions 7.3.4-7013 and 8.2.3-8015, and there are no workarounds, so SonicWall urges customers to upgrade as soon as possible. The warning follows a series of attacks this year on the company's SMA1000 remote access appliances.