SonicWall has released updates for seven SonicOS vulnerabilities affecting Gen7 and Gen8 firewall platforms, including virtual appliances. These issues include unauthorized management operations, authentication bypass, credential exposure and denial of service.
CVE-2026-19868 affects SSLVPN logins when SAML is enabled. An attacker with valid credentials for another authentication method may bypass SAML authentication and, potentially, its multifactor-authentication controls. This is not a claim that every SonicOS login or every MFA deployment is affected.
The Canadian Centre for Cyber Security reports that CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026. MS-ISAC advisory 2026-126 says SonicWall investigated potential exploitation of that vulnerability and has not reported exploitation of the other vulnerabilities in this advisory.
What to do: Identify affected appliances, review SonicWall advisory SNWLID-2026-0014 for the exact model and firmware requirements, and apply the relevant updates promptly after appropriate testing. Prioritize exposed systems. Review administrative access and use least privilege and network segmentation to reduce exposure.
Source version ranges differ across public summaries, so this summary deliberately does not prescribe a firmware build. Use SonicWall's current model-specific advisory as the authoritative upgrade guide.
Sources:
- SonicWall: psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
- NHS England: digital.nhs.uk/cyber-alerts/2026/cc-4886
- Canadian Centre for Cyber Security: cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-1133
Based on MS-ISAC TLP:CLEAR advisory 2026-126 issued November 10, 2026, corroborated with the public sources above.