SonicOS 7.3.4-7013 vs 7015: Which Build to Install for the SonicWall SSL VPN Fix, and What the Release Notes Show

If your SonicWall firewall moved to SonicOS 7.3.4-7013 in October, you may assume the exploited SSL VPN flaw CVE-2026-19868 is dealt with. SonicWall's notice does count that build as fixed, but the 7013 release notes show the matching ticket by number only, and six related tickets appear only in the notes for the newer 7.3.4-7015, so we recommend installing 7015.

Our earlier post on CVE-2026-19868 covers the flaw itself and how to review VPN logs. This one looks at the build question, and at what to check before you upgrade.

SonicOS 7.3.4-7013 vs 7015: what each page says

The six other Gen 7 tickets cover a pre-authentication overflow in SSL-VPN, two pre-authentication overflows in TACACS+, weak password hashing and two cross-domain policy flaws. None of those six ticket numbers appears in the 7013 notes.

What is confirmed about CVE-2026-19868

• CISA's Known Exploited Vulnerabilities entry added the flaw on November 6, 2026, with a November 20 due date for US federal agencies.
• CISA describes a user with valid credentials for an alternate authentication method bypassing SAML controls, and says exploitation may also bypass SAML-enforced MFA.
• The Canadian Centre for Cyber Security states that SonicWall indicates the flaw is being exploited.
• The CVE record lists 7.3.3-7015 and older, and 8.2.2-8015 and older, as affected. It shows a 7.5 score assigned by CISA. The 8.8 on SonicWall's notice is one score given for the whole advisory.

What is our reading, and what is not known

Our reading: the support notice never names this CVE. We connect them because the CVE record and CISA both point to advisory SNWLID-2026-0014, the ID on the notice. We connect ticket GEN7-58695 to the CVE because its title matches the CVE description and it cites that advisory. No release note prints the CVE number.

Not known:

• Whether 7013 contains the six fixes its notes do not list. Absence from release notes does not prove a fix is missing, and SonicWall's notice counts 7013 as fixed.
• Why 7015 followed 7013 about two weeks later. The pages we could open do not explain how the two builds differ.
• What SonicWall's full advisory says in detail. The page did not load as readable text for us, so check it directly for workarounds and per-CVE versions.
• Who is exploiting the flaw, and how widely. CISA lists ransomware use as unknown.

Which SonicOS version to install this week

Check the full build number on every firewall, not just "7.3.4". Include branch units and virtual NSv firewalls.

The 7015 recommendation is our judgment, not a SonicWall instruction.

Before you upgrade to SonicOS 7.3.4

The 7015 release notes carry several warnings worth reading first:

• No way back. SonicWall says downgrading from 7.3.4 to a lower version is not supported. Back up your configuration and book a maintenance window.
• Pinned GeoIP address. If you pinned the GeoIP server to 204.212.170.21, switch to default resolution or set 204.212.170.31. Default setups need no action.
• Management tools. Network Security Manager On-Premises 4.4 is required to manage 7.3.4 firewalls. Firewalls on 7.1.x or later cannot be managed through GMS, which we covered in our GMS post.
• Compliance. SonicOS 7.3.4 is not FIPS or Common Criteria certified. If a contract or regulator requires those, raise it before upgrading.
• Local accounts. Cleaning up alternate sign-in methods is sensible, but SonicWall's knowledge base says SAML administrators also need a matching local account in the SonicWall Administrators group. Deleting every local account could lock out your admins.

Why this matters for a company network

As described, this flaw matters where SAML protects SSL VPN logins and another sign-in method still works. A business may have paid for single sign-on and MFA precisely so that a stolen password is not enough, and this flaw targets that assumption. A firewall left on the wrong build also tends to stay there, because nobody revisits a device that was patched last month. If you have a managed provider, ask for the exact build on each unit.

SonicOS 7.3.4 questions people are asking

Is SonicOS 7.3.4-7013 patched against CVE-2026-19868?

SonicWall's notice lists 7013 and above as fixed for the advisory tied to this CVE, and the matching ticket appears by number in the 7013 notes. The description and advisory reference appear only in the 7015 notes.

Should I upgrade from 7.3.4-7013 to 7.3.4-7015?

We recommend it. It is the Gen 7 build whose notes document all seven fixes tied to the advisory.

Does the SonicWall SSL VPN flaw bypass MFA?

CISA says exploitation may bypass SAML-enforced MFA. The attacker needs valid credentials for an alternate authentication method.

Is SonicOS 8.2.2-8015 safe?

No. SonicWall's notice and the CVE record both list 8.2.2-8015 as affected. Canada's bulletin says "prior to 8.2.2-8015", so go by the vendor's fixed version, 8.2.3-8015.

Can I roll back after upgrading to SonicOS 7.3.4?

SonicWall says downgrading from 7.3.4 is not supported. Test where you can and keep a configuration backup.

Will Gen 6 SonicWall firewalls get a fix?

No. SonicWall's notice says Gen 6 and older are end-of-support and will not receive these fixes, and it recommends moving to Gen 8.

The bigger lesson

A fixed version on a notice is where checking starts. When a vendor ships two builds in two weeks and documents them differently, the safe move is the build with the clearest record, confirmed on every device. That is the same point we made in Updated Is Not the Same as Patched.

If you want your firewalls inventoried and upgraded properly, see our security hardening service or request a quote.

Get security alerts by email, with the free checklist, at our security alerts page.

Sources: SonicWall support notice; SonicOS 7.3.4-7013 release notes; SonicOS 7.3.4-7015 release notes; SonicOS 8.2.3-8015 release notes; CISA KEV catalog; Canadian Centre for Cyber Security AV26-1133; CVE record via OpenCVE; SonicWall SAML knowledge base article.