SonicWall releases patches for 7 flaws in its firewalls, most involving unauthenticated access

SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of “potential” active exploitation of at least one of the bugs, CVE-2026-19868, a bypass of SAML authentication controls in its SonicOS SSL VPN service.  And Frank Dickson, principal analyst at Dickson Research, pointed out that these flaws involve different SonicWall product lines to those recently reported. “The July zero-day and the September holes hit SonicWall’s SMA 1000 remote access appliances,” he said. “This one hits SonicOS, the operating system on its Gen 7 and Gen 8 firewalls. The pattern has jumped product lines. That makes it a vendor issue, not a product issue. Credit where due: SonicWall flagged the exploitation report in its own advisory and the fix shipped with the disclosure.” The seven vulnerabilities are: CVE-2026-107155, a permissive cross-domain policy vulnerability, with a CVSS score of 8.8; CVE-2026-107154, a session validation vulnerability, also with a CVSS score of 8.8; CVE-2026-82308, a pre-authentication heap buffer overflow vulnerability in SSL-VPN, with a CVSS score of 7.5; CVE-2026-19868, an authentication enforcement vulnerability via alternate authentication methods, with a CVSS score of 7.1; CVE-2026-77708, a pre-authentication stack buffer overflow vulnerability in TACACS+, with a CVSS score of 5.9; CVE-2026-77709 , a pre-authentication heap buffer overflow vulnerability in TACACS+, with a CVSS score of also 5.9; and CVE-2026-19703, a weak password hashing hole with a CVSS score of 5.2. SonicWall only provided a workaround for one of the bugs, CVE-2026-19868; it involves disabling or deleting any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall. A ‘mixed bag’ Dickson said the newly reported holes are a mixed bag. “SonicWall’s advisory rates its SAML bypass, CVE-2026-19868, a 7.1, below two 8.8 management interface flaws,” Dickson said. “Yet it is the one CISA added to its Known Exploited Vulnerabilities catalog the same day SonicWall disclosed it. SonicWall describes ‘potential exploitation’ but CISA says active. I would listen to CISA.” The bug lets anyone holding valid credentials for another login method, such as a local account or LDAP, skip SAML and the MFA that rides on it, he noted, adding “companies moved their VPNs to SAML precisely so every login passes through the identity provider and its MFA prompt. This flaw breaks that promise.” Some of the other authentication holes are potentially less severe, however. “Three are pre-authentication buffer overflows whose stated impact is denial of service. They knock the VPN offline but they do not open it,” Dickson said. “The two 8.8 flaws work only under specific conditions. None of the six is known to be exploited. They matter, [but] they are not the headline.” Could be combined Sav Wheeler, malware research engineer at Malwarebytes, added that even though some of these holes do not appear to be especially serious on their own, they could be combined to be much more dangerous.  “These scattered vulnerabilities at various stages of the authentication process combine to form a pathway where an attacker can bypass authentication almost entirely to penetrate a system and steal credentials,” Wheeler said. “The weak password hashing is a cherry on top for attackers that have already gained an initial foothold.” He sees CVE-2026-19868 as “the biggest individual vulnerability” because the potential MFA bypass through alternative authentication means that “the entire trust boundary of MFA could be effectively nonexistent even when an organization depends on it for security.” He noted, however, that although the attacker does need valid credentials for an alternate authentication method for this to work, “otherwise it requires little effort and resources to gain access, as they’re not compromising the MFA itself. Combined with the use of IP addresses for validation (CVE-2026-107154), which itself provides little security, this is a serious failure of authentication policy to ensure a user is who they claim to be.” Sanchit Vir Gogia, chief analyst at Greyhound Research, said that the biggest danger is when SAML sits atop older directory logins that stay live.  “Remote access is the lifeblood of a distributed business, and one stolen directory password now reaches it. CISOs who rolled out SAML to end password-only access have cause to feel let down. SonicWall owes them a full account of how the second path stayed open.” A vendor risk management issue These continuing SonicWall vulnerabilities are a real issue, although the September and October flaws sit in another product, Gogia said. “Those hit the SMA1000 remote-access gateway, while this advisory covers SonicOS firewalls. But thirteen of SonicWall’s twenty entries in CISA’s exploited list carry the flag for known ransomware use, the highest share among eight edge vendors.” Dickson noted that the next steps for enterprise CISOs are trickier because the fault here might lie less with a vendor than with the product category itself. “The internet-facing VPN appliance is the Achilles’ heel of the perimeter, whoever builds it,” he pointed out. “Swapping vendors swaps one heel for another. The pattern should change how CISOs deploy the edge, not just whose logo is on it. Ask SonicWall whether these are new bugs or the same bug classes coming back.” However Erik Avakian, technical counselor at Infotech, said he was less willing to let SonicWall off the hook that easily. “Any vendor can and is generally going to experience vulnerabilities, but when we see repeated critical security issues affecting the same vendor that represent a pattern, particularly involving authentication and internet-facing infrastructure, it raises legitimate questions about their secure development practices, quality assurance, and the effectiveness of their own internal vulnerability management processes,” Avakian said. “At some point, this becomes more than just an individual vulnerability management issue. It becomes a vendor risk management issue.” He noted that CISOs need to evaluate whether the frequency and severity of these vulnerabilities are creating an unacceptable level of recurring exposure for their organization. “That doesn’t automatically mean replacing SonicWall products, but it does require holding the vendor accountable for improvement and to demonstrate their ability to address the underlying problems,” he said. Additional preventive measures In addition, Dickson suggested other ways CISOs can protect themselves in light of these new holes, beyond the obvious step of patching them. “List every way the VPN can authenticate a user: local accounts, LDAP, RADIUS, and TACACS+. Delete what you do not need, especially leftover local admin and service accounts. Rotate passwords on every non-SAML account that remains,” he advised. “Compare VPN logins against identity provider sign-ins. A VPN session with no matching SAML sign-in is your red flag. Look back as far as your logs go, since SonicWall has not said when exploitation began. And take the management interface off the open internet.”