MS-ISAC Advisory 2026-126 issued November 10, 2026; CVE-2026-19868 added to the CISA KEV catalog November 6, 2026, federal remediation due November 20, 2026
Seven Flaws in the Firewall Itself: SonicOS Patches Land as the SAML Bypass Sits on the Exploited List
The perimeter device is the subject again. MS-ISAC Advisory 2026-126, issued today, November 10, documents seven vulnerabilities in SonicWall SonicOS across its management interface, SSLVPN service and TACACS+ authentication client, affecting Gen7 hardware and virtual firewalls on version 7.3.3-7015 and earlier and Gen8 hardware and virtual firewalls on 8.2.2-8015 and earlier. The head of the list is one readers met last week: CVE-2026-19868, the SSLVPN authentication enforcement flaw that lets a user holding valid credentials for an alternative method bypass SAML authentication and any multi-factor step SAML carries, which CISA placed in the KEV catalog on November 6 with a November 20 federal deadline, and which SonicWall has investigated for potential exploitation. The other six are new in this advisory and carry no reported exploitation: CVE-2026-107154, a session validation flaw in the management interface that can let a remote unauthenticated attacker perform unauthorized operations under specific conditions; CVE-2026-107155, a permissive cross-domain policy flaw in the same interface with a similar reach; CVE-2026-19703, a weak password hashing flaw in virtual appliances that can disclose a platform credential to an attacker who already holds local access; CVE-2026-82308, a pre-authentication heap buffer overflow in SSLVPN documented as an application denial of service; and CVE-2026-77708 and CVE-2026-77709, stack and heap buffer overflows in the TACACS+ client, both pre-authentication and both documented as denial of service. MS-ISAC maps the set to MITRE ATT&CK technique T1190, exploit public-facing application, and recommends applying the SonicWall updates immediately after appropriate testing, restricting management interface exposure, and segmenting administrative infrastructure. The pattern across the seven is the lesson: three of them live in authentication machinery itself, the layer whose entire job is deciding who gets in.
Executives
Your firewall vendor asking for an urgent update to the firewall is a recurring cost of the architecture, not an anomaly, and SonicWall customers have now had a KEV-listed bypass and a seven-flaw advisory inside a week. The executive question is exposure shape: is the management interface of any of these appliances reachable from the internet, and if so, why. That answer, plus the patch date for the SAML bypass ahead of its November 20 deadline, is the whole briefing. Budget and staffing follow from those two facts.
CIO / CISO
Patch in the order the evidence dictates: CVE-2026-19868 first, because it is exploited and it defeats the SAML and multi-factor enforcement remote access depends on, then the two unauthenticated management interface flaws, then the rest of the set in the same change where testing allows. While the change is scheduled, close the compensating gaps the advisory names: management access limited to trusted networks, SSLVPN authentication paths reviewed so no alternative method under-enforces the policy, and virtual appliances included in scope, since the hashing flaw lives there. Review SSLVPN logs for logins that skipped the expected SAML path.
Engineers
Confirm versions against the advisory ranges before assuming coverage: Gen7 at 7.3.3-7015 and earlier and Gen8 at 8.2.2-8015 and earlier are in scope, hardware and virtual alike. Take configuration backups before updating, apply the fixed SonicOS release for your generation, and verify the running version after reboot. Then do the configuration work the patch cannot: enumerate every enabled SSLVPN authentication method and confirm each one enforces the same SAML and multi-factor policy, and confirm the management interface answers on no internet-facing address.
Everyone (non-IT)
If you sign in to work through a SonicWall VPN, expect a maintenance window and possibly a changed sign-in flow this week. That is the fix arriving, not a problem with your account. What should not change is where you type your password: only the VPN client and sign-in page you already use. A message asking you to install a new VPN tool or re-enter credentials on a fresh page, arriving while patching is in the news, deserves a call to your IT team before it deserves a click.