8 NOV 2026 — SonicWall has released SonicOS firmware that fixes seven vulnerabilities in its Gen7 and Gen8 firewalls, one of which it says may already have been used in an attack. The exploited flaw, CVE-2026-19868, can let someone with valid credentials for a different login method get past SAML sign-in on the SSL-VPN service, and past any multi-factor authentication that SAML enforces. The US Cybersecurity and Infrastructure Security Agency (CISA) added it to its catalogue of exploited vulnerabilities on 6 November and gave federal civilian agencies until 20 November to act.
The advisory, SNWLID-2026-0014, was published on 6 November. It says "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability" and urges customers to upgrade as soon as possible. The company gives no detail of the attack and no workaround. The flaw matters only where SAML is switched on for SSL-VPN logins. The advisory says it "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins."
Affected are Gen7 TZ, NSa, NSsp and NSv firewalls on 7.3.3-7015 or older, fixed in 7.3.4-7013, and Gen8 TZ, NSa and NSv units on 8.2.2-8015 or older, fixed in 8.2.3-8015. The same releases close the other six bugs. Two in the management interface score 8.8, a pre-authentication heap overflow in the SSL-VPN service scores 7.5, two overflows in the TACACS+ client score 5.9, and weak password hashing on virtual appliances scores 5.2.
The exploited bug is not the worst-scored
SonicWall rates CVE-2026-19868 at 7.1, fourth of the seven scores in its own advisory. Its vector assumes an attacker with some credentials and rates the attack as hard to pull off. Three higher-scored bugs in the same release have no reported exploitation. CISA scored the flaw differently. Its entry on the National Vulnerability Database record gives 7.5 and marks the privileges needed as none. Its triage notes on that record mark exploitation as "active". Administrators who want to compare the two vectors can enter both in our CVSS 3.1 calculator.
A count of the CISA Known Exploited Vulnerabilities catalogue from its JSON feed (version 2026.11.06, 1,769 entries) puts SonicWall at 20 entries, 14th among vendors. Five were added this year, as many as in all of 2025, but the first four were SMA1000 remote-access appliances. This is the first SonicOS firewall entry of 2026 and the fourth SonicOS entry in the catalogue. The feed lists ransomware use for this one as "Unknown".
The catalogue as a whole is growing faster. It took 285 additions between 1 January and 6 November 2026, against 216 over the same dates in 2025. That is 69 more, or about 32% (285 divided by 216 is 1.32), and already 40 above the 245 added in the whole of 2025.
The federal deadline falls 14 days after the listing, under CISA's directive BOD 26-04. It binds only US federal civilian agencies. When we checked on 8 November, Singapore's Cyber Security Agency had not posted an alert on this advisory. Its alerts list last mentioned SonicWall on 8 October, for the SMA1000 series.
View author profile → · Editorial policy
