SonicWall SonicOS: the exploited SSL-VPN MFA bypass

What happened

SonicWall published an advisory on November 6 fixing seven SonicOS vulnerabilities, among them CVE-2026-19868: when an SSL-VPN service is configured for SAML authentication, an attacker holding valid credentials for an alternate authentication method can bypass the SAML authentication controls, including the multi-factor authentication enforced by the identity provider. SonicWall PSIRT says it "investigated a report indicating potential exploitation" of the flaw. The same day, CISA added it to the Known Exploited Vulnerabilities catalog, with federal agencies required to remediate by November 20; the Canadian Centre for Cyber Security confirms the exploitation the vendor reported. The advisory also fixes two management-interface flaws rated 8.8, pre-authentication denial-of-service buffer overflows, and weak password hashing on virtual appliances.

Why it matters for a hotel

The SonicWall SSL-VPN is one of the most widely deployed remote-access doors in hotels: the IT contractor driving the PMS remotely, the reservations center, the accounting team working from home, the integrator reaching the access-control controller. All of that traffic leans on one guarantee: a stolen password is not enough, because the second factor stops the intruder. This flaw removes that guarantee. Once any local or LDAP credential is stolen, the attacker opens a VPN tunnel that looks legitimate in every log, and never faces the second factor. Hotel-side VPN access typically means the back-office network, a few hops from the PMS, the key-card server and the cash office.

Who is affected

SonicOS Gen7 up to 7.3.3-7015 and Gen8 up to 8.2.2-8015, across the TZ, NSa, NSsp and NSv lines, in the single case where the SSL-VPN service uses SAML as its authentication method. Appliances whose SSL-VPN is disabled, or does not use SAML, are not exposed by this flaw. Fixed versions are 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8); the vendor offers no workaround. The narrow scope means some appliances are off the hook: check the service configuration before concluding.

How to fix it

1. Inventory every SonicWall appliance in the estate and its SonicOS version, including units managed by an outsourced provider.
2. Upgrade to 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8) or later, scheduled in a maintenance window because the update reboots the appliance.
3. Audit SSL-VPN logs since November 6: validated SAML sessions, logins from unusual addresses, new accounts or firewall rules.
4. Rotate credentials for every alternate authentication method still active on unpatched units, and remove dormant contractor accounts.
5. If the upgrade must wait: temporarily disable SSL-VPN or move essential remote access to another channel until patching is done.
6. While you are in there, confirm the management interface is not reachable from the internet, the precondition for the other flaws in the same advisory.

Context

The disclosure lands in a run of attacks against SonicWall's remote-access line: two chained zero-days on SMA1000 appliances in September leading to code execution, then exploitation attempts against CVE-2026-102255 in October. SonicWall has not detailed the exploitation tied to CVE-2026-19868; the exploited-in-the-wild characterization here rests on CISA's KEV listing and the report SonicWall's PSIRT examined.