SonicWall Firewall Owners: Install the November 6 SonicOS Update

If your office uses a SonicWall Gen7 or Gen8 firewall for remote access, install SonicWall's November 6, 2026 SonicOS update. On the same day, CISA added one of the flaws in that advisory, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog, and SonicWall said it is investigating a report of potential exploitation.

The short version: update Gen7 appliances to SonicOS 7.3.4-7013 or newer, and Gen8 appliances to 8.2.3-8015 or newer. If SSLVPN is set to use SAML, treat this as urgent even if you believe MFA is already on.

What the flaw does

According to SonicWall advisory SNWLID-2026-0014, CVE-2026-19868 is an authentication-enforcement issue in the SonicOS SSLVPN service. A user who has valid credentials for an alternate authentication method may be able to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).

SonicWall notes that this issue only affects SSLVPN when SAML is enabled for SSLVPN logins. CISA's catalog entry describes the same behavior and set a federal remediation due date of November 20, 2026. CISA lists known ransomware campaign use as Unknown.

The same advisory also covers six other SonicOS issues published the same day, including two management-interface flaws SonicWall scores at CVSS 8.8 (CVE-2026-107154 and CVE-2026-107155), a pre-authentication SSLVPN heap overflow that can cause an application-level denial of service (CVE-2026-82308, CVSS 7.5), TACACS+ denial-of-service issues, and a weak password-hashing issue on virtual appliances. SonicWall rates the overall advisory impact as high (CVSS 8.8) and says no workaround is available.

Who is at risk

SonicWall lists these platforms when running the affected firmware:

• Gen7 hardware: TZ 270/270W, 370/370W, 470/470W, 570/570W/570P, 670; NSa 2700–6700; NSsp 10700–15700 — affected on SonicOS 7.3.3-7015 and older
• Gen7 virtual (NSv): NSv 270, 470, 870 on ESX, KVM, Hyper-V, AWS, or Azure — same Gen7 firmware line
• Gen8 hardware: TZ 80, 280/280W, 380/380W, 480, 580, 680; NSa 2800–5800 — affected on SonicOS 8.2.2-8015 and older
• Gen8 virtual (NSv): NSv XS, S, M, L on ESX, KVM, Hyper-V, AWS, or Azure — same Gen8 firmware line

The SAML bypass matters most if employees or partners sign into SSLVPN with SAML. The management-interface and SSLVPN denial-of-service issues matter whenever the firewall management page or SSLVPN service can be reached from an untrusted network.

What to do this week

1. Check the model and SonicOS version. Confirm whether each firewall is Gen7 or Gen8 and note the exact firmware build.
2. Install the fixed release. Upgrade Gen7 to 7.3.4-7013 or higher, and Gen8 to 8.2.3-8015 or higher, using SonicWall's published images for your model.
3. If SSLVPN uses SAML, verify MFA still applies after the update. Confirm users cannot sign in through an alternate method that skips SAML MFA.
4. Keep management off the internet. Restrict the firewall management interface to trusted admin networks. SonicWall lists no workaround other than upgrading.
5. Review recent SSLVPN and admin logins. Look for unexpected successful VPN sessions around the time of the advisory, especially if SAML was enabled.

Questions to ask your IT provider

1. Are our SonicWall firewalls on Gen7 7.3.4-7013+ or Gen8 8.2.3-8015+?
2. Is SAML enabled for SSLVPN, and has MFA been re-checked after the update?
3. Can the management interface or SSLVPN be reached from the public internet?
4. Have recent SSLVPN and admin logs been reviewed for unusual successful sign-ins?