For: organisations that run SonicWall Gen7 or Gen8 firewalls (TZ, NSa, NSsp, NSv) with SSL-VPN, especially where SSL-VPN logins go through SAML and multi-factor authentication, and the partners who manage these firewalls. This page is based on SonicWall's security advisory SNWLID-2026-0014, NVD and CISA's KEV catalog; it contains no attack steps or exploit code.
Developing: this page will be updated as more is published
- Who is affected
organisations that run SonicWall Gen7 or Gen8 firewalls (TZ, NSa, NSsp, NSv) with SSL-VPN, especially where SSL-VPN logins go through SAML and multi-factor authentication, and the partners who manage these firewalls.
- Confirmed so farSee the table ↓
- Affected and fixed versions
- Condition: SAML enabled for SSL-VPN logins
- SAML-enforced MFA can be bypassed
2 more
- Listed as known exploited
- Workaround
Listed as possibly affected
- Exploitation
- Not yet confirmed
- How many firewalls were attacked or compromised
- Whether the exploitation report SonicWall investigated has been confirmed
- Which other authentication methods are involved, in detail
- What to do nowSee the steps ↓
- Find your Gen7 and Gen8 firewalls and their SonicOS version
- Upgrade to the fixed version
- Check whether SSL-VPN logins use SAML
2 more
- Review the accounts that can sign in to SSL-VPN without SAML
- Review recent SSL-VPN logins
- Where to verify (source)All sources ↓
- SonicWall PSIRT, "SonicWall SonicOS Affected By Multiple Vulnerabilities" (SNWLID-2026-0014, version 1.0, November 6, 2026)
- Last checked
- As of November 7, 2026, 16:00 (JST)
Follow-up plans and what we checked
SonicWall's advisory (version 1.0, November 6) and the KEV entry are public. We checked the advisory, NVD (status: Undergoing Analysis) and CISA's KEV feed (version 2026.11.06) on November 7.
What to do today
Find your Gen7 and Gen8 firewalls and their SonicOS version
Note the SonicOS version of every firewall, including virtual NSv firewalls in ESX, KVM, Hyper-V, AWS and Azure, and spare or lab units. SonicWall's advisory lists Gen7 on 7.3.3-7015 and older and Gen8 on 8.2.2-8015 and older as affected.
Upgrade to the fixed version
Gen7 (TZ, NSa, NSsp, NSv): 7.3.4-7013 or higher. Gen8 (TZ, NSa, NSv): 8.2.3-8015 or higher. SonicWall lists no workaround, so the upgrade is the fix. Take a configuration backup first, and plan the restart, since the firewall carries all traffic through it.
Check whether SSL-VPN logins use SAML
SonicWall says CVE-2026-19868 only affects SSL-VPN if SAML is enabled for SSL-VPN logins. If it is, the firewall is in scope for the MFA bypass. If it is not, you are not exposed to this CVE, but the same advisory has six other CVEs for the same versions, so still upgrade.
Review the accounts that can sign in to SSL-VPN without SAML
SonicWall describes the bypass as using valid credentials for an alternate authentication method. As a general step of our own (not from SonicWall, and not a replacement for the upgrade), list the accounts that can sign in to SSL-VPN through any other method, such as local users or a directory, remove those you do not need, and change passwords that may have been reused or leaked.
Review recent SSL-VPN logins
As our own check, compare recent SSL-VPN logins with what you expect: logins that did not go through your SAML identity provider, from unexpected places, or by accounts that should only use SAML. If you find any you cannot explain, treat that account as compromised, reset its credentials and contact SonicWall support.
What was disclosed
- Product
- SonicWall SonicOS, the operating system of SonicWall's Gen7 and Gen8 firewalls; the SSL-VPN service
- Type
- Authentication enforcement flaw: a valid credential for an alternate authentication method may bypass SAML controls and SAML-enforced MFA (CWE-308, use of single-factor authentication)
- Condition
- Only when SAML is enabled for SSL-VPN logins (SonicWall)
- Severity
- CVSS v3.1 7.1 (SonicWall). CISA's added score in NVD: 7.5
- Affected
- Gen7 on 7.3.3-7015 and older; Gen8 on 8.2.2-8015 and older
- Fixed
- Gen7 7.3.4-7013 and higher; Gen8 8.2.3-8015 and higher
- Workaround
- None (SonicWall)
- Exploitation
- SonicWall's security team investigated a report indicating potential exploitation
- KEV
- Added November 6, 2026; due November 20. Not marked for CISA's forensic triage requirements
1. Find versions
Gen7 and Gen8, including NSv
2. Upgrade
7.3.4-7013 / 8.2.3-8015 or later
3. Check VPN sign-ins
Accounts outside SAML; recent logins
Affected models and fixed versions
| Platform (per SonicWall's advisory) | Affected | Fixed |
|---|---|---|
| Gen7 hardware: TZ 270 to TZ 670, NSa 2700 to NSa 6700, NSsp 10700 to NSsp 15700 | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen7 NSv: NSv 270, 470, 870 (ESX, KVM, Hyper-V, AWS, Azure) | 7.3.3-7015 and older | 7.3.4-7013 and higher |
| Gen8 hardware: TZ 80 to TZ 680, NSa 2800 to NSa 5800 | 8.2.2-8015 and older | 8.2.3-8015 and higher |
| Gen8 NSv: NSv XS, S, M, L (ESX, KVM, Hyper-V, AWS, Azure) | 8.2.2-8015 and older | 8.2.3-8015 and higher |
The advisory lists only Gen7 and Gen8. It does not say anything about older generations.
The six other CVEs in the same advisory
SonicWall's advisory SNWLID-2026-0014 covers seven CVEs in total, all fixed by the same versions. Only CVE-2026-19868 is in the KEV catalog.
| CVE | What SonicWall says | CVSS v3.1 (SonicWall) |
|---|---|---|
| CVE-2026-107155 | Permissive cross-domain policy in the management interface; in specific conditions, a remote unauthenticated attacker could perform unauthorized operations | 8.8 |
| CVE-2026-107154 | Session validation flaw in the management interface, with the same possible effect | 8.8 |
| CVE-2026-82308 | Pre-authentication heap buffer overflow in SSL-VPN that could stop the service | 7.5 |
| CVE-2026-77708 / CVE-2026-77709 | Pre-authentication buffer overflows in the TACACS+ authentication client that could stop the service | 5.9 each |
| CVE-2026-19703 | Weak password hashing on virtual appliances; an attacker who already has local access could obtain a platform credential | 5.2 |
Timeline
November 6, 2026 (UTC)
SonicWall publishes advisory SNWLID-2026-0014 (version 1.0) covering seven CVEs, with fixed versions. NVD publishes the CVE record.November 6
CISA adds CVE-2026-19868 to the KEV catalog with a due date of November 20.November 7
No revision of the advisory; NVD status Undergoing Analysis.November 20
The KEV due date for US federal agencies.
What is known and not known
| Item | What the sources say | Status |
|---|---|---|
| Affected and fixed versions | Gen7 up to 7.3.3-7015, Gen8 up to 8.2.2-8015; fixed in 7.3.4-7013 and 8.2.3-8015 | Confirmed (SonicWall) |
| Condition: SAML enabled for SSL-VPN logins | Stated in the advisory | Confirmed (SonicWall) |
| SAML-enforced MFA can be bypassed | Stated in the advisory and the KEV entry | Confirmed (SonicWall) |
| Exploitation | SonicWall investigated a report indicating potential exploitation | Possible (SonicWall) |
| Listed as known exploited | Added to KEV on November 6 | Exploitation confirmed (CISA) |
| Workaround | None | Confirmed (SonicWall) |
| Number of firewalls attacked | Not published | Not stated |
| Details of the alternate authentication methods | Not published | Not stated |
Why MFA through SAML is the point here
Many organisations put SAML in front of SSL-VPN so that every login goes through their identity provider and its MFA. A stolen password alone should then not be enough. This flaw removes that guarantee on affected versions: SonicWall says a valid credential for another authentication method may be enough to get past SAML and its MFA.
That changes which accounts matter. The accounts at risk are not only the SAML users, but any account that can still sign in to SSL-VPN another way, including ones created during setup and never removed. Passwords from past leaks or reused elsewhere become usable again on the VPN. This is why we suggest reviewing those accounts, in addition to the upgrade.
The score is also lower than the risk. SonicWall rates it 7.1 and assumes a low-privileged account is needed. A queue sorted by CVSS would place it below many others, but the KEV listing and SonicWall's own warning put it at the top (see how to decide which CVEs to fix first).
Sources
Checked on November 7, 2026 (JST).
- SonicWall PSIRT, "SonicWall SonicOS Affected By Multiple Vulnerabilities" (SNWLID-2026-0014, version 1.0, November 6, 2026) — psirt.global.sonicwall.com
- NVD, CVE-2026-19868 — nvd.nist.gov
- CISA, Known Exploited Vulnerabilities Catalog (added November 6, 2026) — cisa.gov
Update history
2026-11-07: First version, based on SonicWall's advisory, NVD and CISA's KEV catalog.
Read next
- Defending exposed devices: How to defend VPN devices and remote access
- Choosing MFA: What phishing-resistant MFA means
- Exploited in October: Exploited edge device vulnerabilities, mid-October 2026
- Prioritising fixes: How to decide which CVEs to fix first (CVSS, EPSS, KEV)
- Terms: What is two-factor authentication? / What is CVSS?