SonicWall releases patches for 7 flaws in its firewalls, most involving unauthenticated access

Publisher excerpt From CSO Online

SonicWall on Monday updated its advisory about seven cybersecurity holes affecting its Gen 7 and Gen 8 firewalls, five of which allow unauthenticated remote attacks, to warn that it is aware of “potential” active exploitation of at least one of the bugs, CVE-2026-19868, a bypass of SAML authentication controls in its SonicOS SSL VPN service. And Frank Dickson, principal analyst at Dickson Research, pointed out that these flaws involve different SonicWall product lines to those recently reported. “The July zero-day and the September holes hit SonicWall’s SMA 1000 remote access appliances,” he said. “This one hits SonicOS, the operating system on its Gen 7 and Gen 8 firewalls. The pattern has jumped product lines. That makes it a vendor issue, not a product issue. Credit where due: SonicWall flagged the exploitation report in its own advisory and the fix shipped with the disclosure.” The seven vulnerabilities are: CVE-2026-107155, a permissive cross-domain policy vulnerability, with a CVSS score of 8.8; CVE-2026-107154, a session validation vulnerability, also with a CVSS score of 8.8; CVE-2026-82308, a pre-authentication heap buffer overflow vulnerability in SSL-VPN, with a CVSS score of 7.5; CVE-2026-19868, an authentication enforcement vulnerability via alternate authentication methods, with a CVSS score of 7.1; CVE-2026-77708, a pre-authentication stack buffer overflow vulnerability in TACACS+, with a CVSS score of 5.9; CVE-2026-77709 , a pre-authentication heap buffer overflow vulnerability in TACACS+, with a CVSS score of also 5.9; and CVE-2026-19703, a weak password hashing hole with a CVSS score of 5.2. SonicWall only provided a workaround for one of the bugs, CVE-2026-19868; it involves disabling or deleting any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall. A ‘mixed bag’ Dickson said the newly reported holes are a mixed bag. “SonicWall’s advisory rates its SAML bypass, CVE-2026-19868, a 7.1, below two 8.8 management interface flaws,” Dickson said. “Yet it is the one CISA added to its Known Exploited Vulnerabilities catalog the same day SonicWall disclosed it. SonicWall describes ‘potential exploitation’ but CISA says active. I would listen to CISA.” The bug lets anyone holding valid credentials for another login method, such as a local account or LDAP, skip SAML and the MFA that rides on it, he noted, adding “companies moved their VPNs to SAML precisely so every login passes through the identity provider and its MFA prompt. This flaw breaks that promise.” Some of the other authentication holes are potentially less severe, however. “Three are pre-authentication buffer overflows whose stated impact is denial of service. They knock the VPN offline but they do not open it,” Dickson said. “The two 8.8 flaws work only under specific conditions. None of the six is known to be exploited. They matter, [but] they are not the headline.” Could be combined Sav Wheeler, malware research engineer at Malw…

Excerpt only, shown with attribution. This content belongs to the original publisher and has not been independently verified by CyberSecurity.pk.