Skip to main content
The Website Services team at NHS England are testing early designs to understand how you find information. Your views will help us check our ideas work. Sign up to take part in our user research.

SonicWall Releases Security Advisory for SonicOS Platforms

Security updates to address seven vulnerabilities, including an actively exploited vulnerability (CVE-2026-19868)

Threat ID:
CC-4486
Threat Severity:
Medium
Published:
9 November 2026 3:11 PM
Report a cyber attack: call 0300 303 5222 or email [email protected]

Summary

Security updates to address seven vulnerabilities, including an actively exploited vulnerability (CVE-2026-19868)

Affected platforms

The following platforms are known to be affected:

SonicWall SonicOS

  • Gen7
    • All prior to 7.3.3-7015
  • Gen8
    • All prior to 8.2.2-8015

Threat details

Exploitation of CVE-2026-19868

The US Cybersecurity and Infrastructure Security Agency (CISA) has added CVE-2026-19868 to its Known Exploited Vulnerabilities Catalog (KEV).

SonicWall has observed exploitation of CVE-2026-19868.

The NHS England National CSOC assesses further exploitation as likely.

Introduction

SonicWall has released a security advisory to address multiple vulnerabilities in SonicOS platforms.

  • CVE-2026-107155 - 'Server-Side Request Forgery (SSRF)' Vulnerability - CVSS v3.1 score: 8.8
  • CVE-2026-107154 - 'Reliance on IP Address for Authentication' Vulnerability - CVSS v3.1 score: 8.8
  • CVE-2026-82308 - 'Heap-based Buffer Overflow' Vulnerability in SSL-VPN - CVSS v3.1 score: 7.5
  • CVE-2026-19868 - 'Use of Single-factor Authentication' Vulnerability - CVSS v3.1 score: 7.1
  • CVE-2026-77708 - 'Stack-based Buffer Overflow' Vulnerability - CVSS v3.1 score: 5.9
  • CVE-2026-77709 - 'Heap-based Buffer Overflow' Vulnerability - CVSS v3.1 score: 5.9
  • CVE-2026-19703 - 'Use of Hard-coded Credentials' Vulnerability - CVSS v3.1 score: 5.2

NOTE: CVE-2026-19868 ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins.

Remediation advice

Affected organisations are encouraged to review SonicWall's Security Advisory SNWLID-2026-0014 and apply the relevant updates as soon as possible.

CVE Vulnerabilities

Status Published

CVE-2026-107155

A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Status Published

CVE-2026-107154

A session validation vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
Status Published

CVE-2026-82308

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS SSL-VPN service, which could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
Status Published

CVE-2026-19868

An authentication enforcement vulnerability in SonicOS SSLVPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).
Status Published

CVE-2026-77708

A pre-authentication stack-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
Status Published

CVE-2026-77709

A pre-authentication heap-based buffer overflow vulnerability has been identified in the SonicOS TACACS+ authentication client, which in specific conditions could potentially enable a remote unauthenticated attacker to cause an application level denial of service.
Status Published

CVE-2026-19703

A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.

Last edited: 9 November 2026 3:11 pm