If a customer uses SAML for SonicWall SSL-VPN, check which other login methods the firewall still accepts. SonicWall’s November 6 advisory describes a path where valid alternate credentials can bypass the SAML login and the MFA enforced there.
New advisory SNWLID-2026-0014, initial release November 6, 2026 at 10:40 UTC. Last verified November 6, 2026. Vendor severity High, with scores up to 8.8 using the advisory’s CVSS 3.1 vectors. Suggested MSP priority Urgent for internet-facing SSL-VPN with SAML enabled or internet-reachable firewall administration.
What makes a firewall applicable
CVE-2026-19868 (7.1) applies when SAML is enabled for SSL-VPN logins and an attacker has valid credentials for an alternate authentication method. SonicWall PSIRT says it investigated a report of potential exploitation. It has published no confirmation of exploitation in this advisory. The CISA catalog reviewed November 6 contains none of these seven CVEs.
- CVE-2026-107154 and CVE-2026-107155 (8.8 each) affect the management interface. Under certain conditions a remote unauthenticated attacker could perform unauthorized operations. Both vectors require user interaction.
- CVE-2026-82308 (7.5) can cause pre-authentication denial of service on the SSL-VPN service.
- CVE-2026-77708 and CVE-2026-77709 (5.9 each) are pre-authentication denial-of-service paths in the TACACS+ client under specific conditions. CVE-2026-19703 (5.2) can disclose a limited platform credential on a virtual appliance to an attacker with privileged local access.
Firmware to deploy
| Firewall generation | Affected SonicOS | Fixed SonicOS |
|---|---|---|
| Gen7 TZ, NSa, NSsp and NSv models listed by SonicWall | 7.3.3-7015 and older | 7.3.4-7013 and later |
| Gen8 TZ, NSa and NSv models listed by SonicWall | 8.2.2-8015 and older | 8.2.3-8015 and later |
The PSIRT matrix includes listed NSv models on ESX, KVM, Hyper-V, AWS and Azure. Confirm the exact model and supported upgrade path in MySonicWall. The public Gen7 release notes also document the later 7.3.4-7015 build. SonicWall lists no workaround for this advisory.
What to do across customer environments
- Inventory Gen7 and Gen8 firewalls by model and firmware. Record internet exposure of SSL-VPN and management, whether SSL-VPN uses SAML, and what alternate credentials or authentication methods still work.
- Restrict WAN management to trusted admin networks. If an affected VPN cannot be patched promptly, limit access or suspend exposure where continuity permits. These steps reduce exposure while you prepare the firmware rollout.
- Back up the configuration, stage the supported fixed firmware and apply it. Verify the running build and HA health where applicable, test that VPN sign-ins enforce the expected MFA policy, and check that management access and integrations work as intended.
- Review firewall VPN and identity-provider sign-in logs for unexpected alternate-method or MFA-free sessions. Where Entra ID supplies SAML, correlate its sign-in events with firewall events. Investigate anomalous sessions through the customer’s incident response process.
Official sources
SonicWall PSIRT advisory · SonicWall PSIRT advisory data and fixed-version matrix · SonicOS 7.3.4 release notes · MySonicWall firmware portal · CISA KEV catalog data