{"id":10364,"date":"2026-11-10T02:36:14","date_gmt":"2026-11-10T02:36:14","guid":{"rendered":"https:\/\/cybersecurityinfocus.com\/?p=10364"},"modified":"2026-11-10T02:36:14","modified_gmt":"2026-11-10T02:36:14","slug":"sonicwall-releases-patches-for-7-flaws-in-its-firewalls-most-involving-unauthenticated-access","status":"publish","type":"post","link":"https:\/\/cybersecurityinfocus.com\/?p=10364","title":{"rendered":"SonicWall releases patches for 7 flaws in its firewalls, most involving unauthenticated access"},"content":{"rendered":"
\n
\n
\n
\n
<\/div>\n

SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of \u201cpotential\u201d active exploitation of at least one of the bugs, CVE-2026-19868, a bypass of SAML authentication controls in its SonicOS SSL VPN service.\u00a0<\/p>\n

And Frank Dickson<\/a>, principal analyst at Dickson Research, pointed out that these flaws involve different SonicWall product lines to those recently reported<\/a>.<\/p>\n

\u201cThe July zero-day and the September holes hit SonicWall\u2019s SMA 1000 remote access appliances,\u201d he said. \u201cThis one hits SonicOS, the operating system on its Gen 7 and Gen 8 firewalls. The pattern<\/a> has jumped product lines. That makes it a vendor issue, not a product issue. Credit where due: SonicWall flagged the exploitation report in its own advisory<\/a> and the fix shipped with the disclosure.\u201d<\/p>\n

The seven vulnerabilities are: CVE-2026-107155, a permissive cross-domain policy vulnerability, with a CVSS score of 8.8; CVE-2026-107154, a session validation vulnerability, also with a CVSS score of 8.8; CVE-2026-82308, a pre-authentication heap buffer overflow vulnerability in SSL-VPN, with a CVSS score of 7.5; CVE-2026-19868, an authentication enforcement vulnerability via alternate authentication methods, with a CVSS score of 7.1; CVE-2026-77708, a pre-authentication stack buffer overflow vulnerability in TACACS+, with a CVSS score of 5.9; CVE-2026-77709 , a pre-authentication heap buffer overflow vulnerability in TACACS+, with a CVSS score of also 5.9; and CVE-2026-19703, a weak password hashing hole with a CVSS score of 5.2.<\/p>\n

SonicWall only provided a workaround for one of the bugs, CVE-2026-19868; it involves disabling or deleting any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall.<\/p>\n

A \u2018mixed bag\u2019<\/h2>\n

Dickson said the newly reported holes are a mixed bag.<\/p>\n

\u201cSonicWall\u2019s advisory rates its SAML bypass, CVE-2026-19868, a 7.1, below two 8.8 management interface flaws,\u201d Dickson said. \u201cYet it is the one CISA added to its Known Exploited Vulnerabilities catalog the same day SonicWall disclosed it. SonicWall describes \u2018potential exploitation\u2019 but CISA says active. I would listen to CISA.\u201d<\/p>\n

The bug lets anyone holding valid credentials for another login method, such as a local account or LDAP, skip SAML and the MFA that rides on it, he noted, adding \u201ccompanies moved their VPNs to SAML precisely so every login passes through the identity provider and its MFA prompt. This flaw breaks that promise.\u201d<\/p>\n

Some of the other authentication holes are potentially less severe, however.<\/p>\n

\u201cThree are pre-authentication buffer overflows whose stated impact is denial of service. They knock the VPN offline but they do not open it,\u201d Dickson said. \u201cThe two 8.8 flaws work only under specific conditions. None of the six is known to be exploited. They matter, [but] they are not the headline.\u201d<\/p>\n

Could be combined<\/h2>\n

Sav Wheeler<\/a>, malware research engineer at Malwarebytes, added that even though some of these holes do not appear to be especially serious on their own, they could be combined to be much more dangerous.\u00a0<\/p>\n

\u201cThese scattered vulnerabilities at various stages of the authentication process combine to form a pathway where an attacker can bypass authentication almost entirely to penetrate a system and steal credentials,\u201d Wheeler said. \u201cThe weak password hashing is a cherry on top for attackers that have already gained an initial foothold.\u201d<\/p>\n

He sees CVE-2026-19868 as \u201cthe biggest individual vulnerability\u201d because the potential MFA bypass through alternative authentication means that \u201cthe entire trust boundary of MFA could be effectively nonexistent even when an organization depends on it for security.\u201d<\/p>\n

He noted, however, that although the attacker does need valid credentials for an alternate authentication method for this to work, \u201cotherwise it requires little effort and resources to gain access, as they\u2019re not compromising the MFA itself. Combined with the use of IP addresses for validation (CVE-2026-107154), which itself provides little security, this is a serious failure of authentication policy to ensure a user is who they claim to be.\u201d<\/p>\n

Sanchit Vir Gogia<\/a>, chief analyst at Greyhound Research, said that the biggest danger is when SAML sits atop older directory logins that stay live.\u00a0<\/p>\n

\u201cRemote access is the lifeblood of a distributed business, and one stolen directory password now reaches it. CISOs who rolled out SAML to end password-only access have cause to feel let down. SonicWall owes them a full account of how the second path stayed open.\u201d<\/p>\n

A vendor risk management issue<\/h2>\n

These continuing SonicWall vulnerabilities are a real issue, although the September and October flaws sit in another product, Gogia said. \u201cThose hit the SMA1000 remote-access gateway, while this advisory covers SonicOS firewalls. But thirteen of SonicWall\u2019s twenty entries in CISA\u2019s exploited list carry the flag for known ransomware use, the highest share among eight edge vendors.\u201d<\/p>\n

Dickson noted that the next steps for enterprise CISOs are trickier because the fault here might lie less with a vendor than with the product category itself.<\/p>\n

\u201cThe internet-facing VPN appliance is the Achilles\u2019 heel of the perimeter, whoever builds it,\u201d he pointed out. \u201cSwapping vendors swaps one heel for another. The pattern should change how CISOs deploy the edge, not just whose logo is on it. Ask SonicWall whether these are new bugs or the same bug classes coming back.\u201d<\/p>\n

However Erik Avakian<\/a>, technical counselor at Infotech, said he was less willing to let SonicWall off the hook that easily.<\/p>\n

\u201cAny vendor can and is generally going to experience vulnerabilities, but when we see repeated critical security issues affecting the same vendor that represent a pattern, particularly involving authentication and internet-facing infrastructure, it raises legitimate questions about their secure development practices, quality assurance, and the effectiveness of their own internal vulnerability management processes,\u201d Avakian said. \u201cAt some point, this becomes more than just an individual vulnerability management issue. It becomes a vendor risk management issue.\u201d <\/p>\n

He noted that CISOs need to evaluate whether the frequency and severity of these vulnerabilities are creating an unacceptable level of recurring exposure for their organization. \u201cThat doesn\u2019t automatically mean replacing SonicWall products, but it does require holding the vendor accountable for improvement and to demonstrate their ability to address the underlying problems,\u201d he said.<\/p>\n

Additional preventive measures<\/h2>\n

In addition, Dickson suggested other ways CISOs can protect themselves in light of these new holes, beyond the obvious step of patching them.<\/p>\n

\u201cList every way the VPN can authenticate a user: local accounts, LDAP, RADIUS, and TACACS+. Delete what you do not need, especially leftover local admin and service accounts. Rotate passwords on every non-SAML account that remains,\u201d he advised. \u201cCompare VPN logins against identity provider sign-ins. A VPN session with no matching SAML sign-in is your red flag. Look back as far as your logs go, since SonicWall has not said when exploitation began. And take the management interface off the open internet.\u201d<\/p>\n<\/div>\n<\/div>\n<\/div>\n<\/div>","protected":false},"excerpt":{"rendered":"

SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of \u201cpotential\u201d active exploitation of at least one of the bugs, CVE-2026-19868, a bypass of SAML authentication controls in its SonicOS SSL VPN service.\u00a0 […]<\/p>\n","protected":false},"author":0,"featured_media":10365,"comment_status":"open","ping_status":"open","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[3],"tags":[],"class_list":["post-10364","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-education"],"_links":{"self":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10364"}],"collection":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/types\/post"}],"replies":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=10364"}],"version-history":[{"count":0,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/posts\/10364\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=\/wp\/v2\/media\/10365"}],"wp:attachment":[{"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=10364"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=10364"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/cybersecurityinfocus.com\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=10364"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}