On 6 November 2026 the US cyber security agency CISA added CVE-2026-19868 to its list of vulnerabilities known to be exploited. It's a flaw in the remote-access login on SonicWall firewalls, and SonicWall's advisory on it, which lists the fixed versions, gives both 5 and 6 November as its first dates. (A CVE is the public reference number given to a security flaw, and a firewall is the box that sits between your office network and the internet.)
The flaw only matters on a firewall where staff log in to the VPN through something called SAML. Whoever looks after your firewall can tell you in a minute whether that's you, and which version it's running.
First, does this apply to you?
This is a flaw in SonicWall's firewall software, called SonicOS, not in a website. If your business doesn't have a SonicWall firewall, you can stop here. If you don't know what's in the comms cupboard, that's worth finding out anyway.
SonicWall's advisory lists its Gen7 and Gen8 firewalls. That includes the TZ models (TZ 270, 370, 470, 570 and 670 in Gen7, and TZ 80, 280, 380, 480, 580 and 680 in Gen8), the larger NSa and NSsp models, and the NSv virtual versions that run in the cloud or on a server.
Then there's the condition. SonicWall's note on this flaw says it "ONLY impacts the SonicOS SSLVPN interface or service if SAML is enabled for SSLVPN logins". The SSL VPN is the firewall's remote-access login, the thing that lets staff connect to the office network from home or on the road. SAML, in my plain version, is a standard that lets a separate login service confirm who someone is, so staff can sign in with an account they already have.
What the flaw lets someone do
SonicWall describes it as a flaw that "may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls", and says it "may also bypass SAML-enforced multi-factor authentication (MFA)".
My reading of that: if a firewall is set up so VPN logins go through SAML, someone holding a valid login for another way of signing in that the firewall also accepts could get in without going through SAML, and possibly without the second check, such as a code on a phone, that SAML was there to enforce. They still need a valid login of some kind. SonicWall doesn't spell out what those other ways are. Its workaround (below) is to switch off any LDAP, RADIUS and TACACS+ login servers, which are services a firewall can check usernames and passwords against, so my inference is that those are the other ways it means.
SonicWall scores it 7.1 out of 10. CISA's entry on the CVE record scores it 7.5. Both sit in the band the scoring system calls high.
What's confirmed and what isn't
SonicWall's advisory carries this note under this flaw and no other: "SonicWall PSIRT has investigated a report indicating potential exploitation of this vulnerability." PSIRT is SonicWall's security response team. That's their wording, and "potential" is their word.
CISA went further. It added the flaw to its Known Exploited Vulnerabilities catalogue on 6 November, and its assessment on the CVE record lists exploitation as active. The catalogue lists ransomware use as unknown.
Neither says how it's been used, or against how many firewalls. As of 10 November I haven't found a primary account that does, so I'm not going to guess.
Which version has the fix
SonicWall's advisory lists the fix in these versions, as of 10 November:
Gen7 firewalls: SonicOS 7.3.4-7013 and higher.
Affected versions are 7.3.3-7015 and older.
Gen8 firewalls: SonicOS 8.2.3-8015 and higher.
Affected versions are 8.2.2-8015 and older.
Six other flaws, and a workaround
The same advisory covers six other flaws, fixed in the same versions. Two of them are in the firewall's management interface, and SonicWall scores each of those two 8.8 out of 10, saying they could let an attacker who isn't logged in do things they shouldn't "in specific conditions". SonicWall's exploitation note sits only under CVE-2026-19868, but the version number is worth asking about even if you don't use SAML.
The advisory lists Gen7 and Gen8 only. It doesn't mention older SonicWall models either way, so if yours is older, that's a question for whoever looks after it.
For a firewall that can't be updated straight away, SonicWall gives a workaround. It revised that section on 9 November, and as of 10 November it reads: "If SAML authentication is in use and upgrading the firmware is not possible, disable or delete any active LDAP, RADIUS, and TACACS+ authentication server configured on the firewall." That's SonicWall's instruction to the people who manage these devices, not mine, and whether it suits your setup depends on how staff log in today.
Sort your own situation
Once you know the model and version, and how VPN logins work, you're in one of these:
No SonicWall in the business.
This flaw doesn't apply.
A Gen7 or Gen8 SonicWall on one of the fixed versions or later.
SonicWall's fix is on from now, though if it was on an affected version with SAML logins before, read the next section.
Firmware from before the fix, with SAML used for VPN logins.
That's exactly the setup SonicWall's note describes, so it's the one to raise today.
Firmware from before the fix, with no SAML.
By SonicWall's note this flaw doesn't apply, but the other six in the same advisory might, so the version is still worth raising.
You don't know what firewall you have, or whose job it is.
That's the finding, and it's bigger than this flaw.
A fix doesn't tell you what happened before
Updating closes the hole from that point on. It doesn't undo anything that happened earlier, and it doesn't tell you whether anything did. Nothing I've read says any particular business has been affected, and I'm not suggesting yours has. If your firewall ran an affected version with SAML logins and you want to know more, working that out is a job for your IT provider or a security professional.
The question to ask
If someone else looks after your network, send them this: "Is our SonicWall on 7.3.4-7013 or later if it's Gen7, or 8.2.3-8015 or later if it's Gen8, and do we use SAML for VPN logins?" Two answers, and you know where you stand.
I build websites, not office networks, so this isn't something I sell a fix for.
What to read next
Are your iPhone, iPad and Mac covered by the fix for CVE-2024-27834?
Apple released the fix in May 2024, and CISA listed the flaw as exploited on 4 November 2026. The question worth asking is what software your business's Apple devices are running, and who knows.
Read articleIs your WordPress site patched against CVE-2026-119977?
WordPress fixed a flaw in its own upgrade process on 28 October, and CISA listed it as exploited on 3 November. The question worth asking is which version your site runs, and who confirmed it.
Read articleIs your Next.js website on a version with the 3 November security fixes?
Vercel published fixes for seven issues in Next.js on 3 November. None is listed as exploited. The useful step is finding out the version and who owns it.
Read articleAbout this notice
Published 2026-11-10 and accurate to the sources linked above as at that date. Security situations move, so check the vendor's own advisory before you act on anything here.
This is general information about a published vulnerability. It's not advice about your site, which nobody can give without looking at it, and nothing here should be treated as a substitute for your own provider or a security professional.
Questions local business owners usually ask next
Not sure what your business runs?
A website is one of the things on that list. If you'd like someone to look at yours from the outside, send me the address and I'll tell you what I can see.