KNOWN EXPLOITED VULNERABILITY · FIX AVAILABLE
The decision: patch exposed SonicOS SSL-VPN systems that use SAML
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026, based on evidence of active exploitation. [3][4]
Reporting cutoff: November 6, 2026, 11:36 PM EST (2026-11-07T04:36:24Z).
This is not an unauthenticated break-in to every SonicWall firewall. SonicWall says the vulnerable path requires valid credentials for an alternate authentication method, and it affects the SonicOS SSL-VPN service only when SAML is enabled for SSL-VPN logins. Successful exploitation may bypass SAML controls and SAML-enforced multi-factor authentication. [1]
Who is exposed
The confirmed exposure predicate is the conjunction of a Gen7 or Gen8 SonicOS hardware or NSv platform, an affected build, the SSL-VPN interface or service in use, SAML enabled for SSL-VPN logins, and an attacker who already has valid credentials for an alternate authentication method. [1][2]
Systems without SAML enabled for SSL-VPN logins are outside this CVE’s stated condition. [1]
Affected and fixed releases
| Platform line | Affected | Fixed |
|---|---|---|
| Gen7 hardware and Gen7 NSv | 7.3.3-7015 and older |
7.3.4-7013 and later [1] |
| Gen8 hardware and Gen8 NSv | 8.2.2-8015 and older |
8.2.3-8015 and later [1] |
SonicWall lists no workaround and urges customers to upgrade to the latest release as soon as possible. [1]
Why the score differs by source
SonicWall’s advisory assigns CVSS v3.1 score 7.1 with privileges required rated low (PR:L), while the CISA ADP data in the CVE Program record assigns 7.5 with privileges required rated none (PR:N). [1][2] The scores should not be averaged; the vendor’s prose still explicitly states that valid alternate-method credentials are required. [1]
Practical response sequence
- Inventory before changing anything. Record the platform line, exact running SonicOS build, whether SSL-VPN is enabled, whether SAML is enabled for SSL-VPN logins, and whether the service is internet-exposed. CISA’s KEV action tells stakeholders to evaluate each asset’s internet exposure. [1][3]
- Preserve short-retention evidence where feasible, then check for prior compromise. CISA says its current directive establishes expectations for checking whether threat actors compromised a system before the patch was applied. [4]
- Upgrade to a fixed build. Move Gen7 systems to
7.3.4-7013or later and Gen8 systems to8.2.3-8015or later; there is no vendor workaround. [1] - Verify the outcome. Confirm the appliance reports the intended fixed build, the SSL-VPN service is available as designed, and SAML/MFA is enforced on the login path your organization expects. This is practical verification guidance derived from the vendor’s exposure condition and fixed-release table. [1]
What remains unknown: SonicWall and CISA do not identify the actor, victim count, campaign, alternate authentication method used in attacks, or CVE-specific indicators of compromise in the reviewed materials. CISA lists known ransomware use as “Unknown.” [1][3] The reviewed sources also do not establish that any Treasure Coast organization or The IT Guys customer was affected. [1][2][3][4][5]
Sources
- SonicWall: SonicOS Affected By Multiple Vulnerabilities (SNWLID-2026-0014) — first published and last updated November 6, 2026; retrieved 2026-11-07T04:36:24Z.
- CVE Program record for CVE-2026-19868 — published November 6, 2026; record updated 2026-11-06T20:58:23.586Z; retrieved 2026-11-07T04:36:24Z.
- CISA Known Exploited Vulnerabilities Catalog — catalog version 2026.11.06, released 2026-11-06T19:44:45.1797Z; retrieved 2026-11-07T04:36:24Z.
- CISA Adds One Known Exploited Vulnerability to Catalog — released November 6, 2026; retrieved 2026-11-07T04:36:24Z.
- Canadian Centre for Cyber Security: SonicWall security advisory AV26-1133 — dated November 6, 2026; retrieved 2026-11-07T04:36:24Z.