SonicWall SSL-VPN flaw CVE-2026-19868 can bypass SAML MFA
SonicWall calls exploitation only potential; Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 need firmware, with no workaround.
74
Vulnerability1 · 1 read
CVE-2026-19703
Weak password hashing in SonicOS virtual appliances
- CVSS 3.1
- 5.1 medium
- EPSS
- —
- Published
- ·
- Modified
AI analysisSummaries by Vani AI
SonicOS virtual appliances use weak password hashing that, under specific conditions, can let an attacker who already has local access and high privileges disclose a platform credential. That credential only opens a limited subset of platform settings. Physical or local access to the appliance is required; remote unauthenticated attackers cannot trigger it.
What to do: Apply SonicWall’s update for CVE-2026-19703. SonicWall has not listed affected or fixed builds.
| Product | Affected |
|---|---|
| SonicWall SonicOS virtual appliances | — |
Estimated exposure
No basis for an estimate.
Order-of-magnitude estimate by the model from install counts, market share and public scan data it knows; verify before quoting.
Description · NVD
A weak password hashing vulnerability has been identified on SonicOS virtual appliances, which in specific conditions could potentially enable an attacker with existing local access to disclose a platform credential. The credential provides access to a limited subset of platform settings.
- Weakness
- CWE-798
- Vector
- CVSS:3.1/AV:L/AC:L/PR:H/UI:N/S:U/C:H/I:L/A:N