SonicWall SSL-VPN flaw CVE-2026-19868 can bypass SAML MFA
SonicWall calls exploitation only potential; Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 need firmware, with no workaround.
74
Vulnerability1 · 1 read
CVE-2026-107155
Permissive cross-domain policy in SonicOS management interface
- CVSS 3.1
- 8.8 high
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
A permissive cross-domain policy vulnerability exists in the SonicOS management interface. In specific conditions, a remote unauthenticated attacker can trigger it via user interaction to perform unauthorized operations. Affected SonicOS users may face data access and modification risks.
What to do: Apply SonicWall's update for CVE-2026-107155.
| Product | Affected |
|---|---|
| SonicWall SonicOS | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A permissive cross-domain policy vulnerability has been identified in the SonicOS management interface, which in specific conditions could potentially enable a remote unauthenticated attacker to perform unauthorized operations.
- Weakness
- CWE-942
- Vector
- CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
In the news
2 storiesCISA adds SonicWall SonicOS MFA bypass to KEV catalog
CISA urges FCEB agencies to patch by November 20, 2026; possible exploitation reported
70