SonicWall patches SonicOS SSLVPN flaw that sidesteps SAML and MFA

SonicWall has patched an authentication bypass in the SSL VPN component of SonicOS, the operating system on its firewalls, and says it looked into a report that the bug was being exploited. The fix is one of seven vulnerabilities in an advisory published on November 6.

The flaw lets someone who holds valid credentials for a different login method get past SAML authentication controls, and SonicWall says successful exploitation may also bypass SAML-enforced MFA. An SSL VPN is exposed only if SAML-based login is enabled. The vendor credits Ryan Harris of The Electronic Office with the report.

Affected devices are Gen7 TZ, NSa, NSsp and NSv firewalls on SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls on 8.2.2-8015 or older. Versions 7.3.4-7013 and 8.2.3-8015 fix it. There are no workarounds, and SonicWall is urging customers to upgrade.

CISA added the flaw to its Known Exploited Vulnerabilities catalog the same day, with a November 20 deadline for federal agencies under Binding Operational Directive 26-04.

Neither the vendor nor CISA has described the suspected attacks, and it's unclear whether the bug was used as a zero-day before a patch existed. If SAML is enabled on your SSLVPN, the version check is the first thing to do.

The other six flaws in the advisory aren't marked as exploited. Two carry a CVSS score of 8.8 and sit in the management interface: a permissive cross-domain policy issue and a session validation bug. Three are pre-authentication buffer overflows in the SSL VPN service and the TACACS+ authentication client, which the advisory ties to application-level denial of service. The last is weak password hashing in virtual appliances, reachable by someone who already has high-privileged local access.

CVE references

CVE-2026-19868