SonicOS 7.3.4 Security Update: Which Build Fixes Exploited CVE-2026-19868, the Six Other Flaws and What Changes When You Upgrade

SonicWall has released SonicOS 7.3.4 and 8.2.3, which fix seven firewall flaws. One of them is CVE-2026-19868, an exploited VPN login bug that can get attackers past SAML and multi-factor authentication. If your business runs a Gen7 or Gen8 SonicWall firewall, it needs one of these builds, and the upgrade cannot be undone: you can't roll back, scripts that use the firewall's API may need changes and you need a newer NSM. So plan it this week instead of clicking through.

We covered the login bypass itself in our earlier post on CVE-2026-19868. This post is about the update: which build to pick, the six other flaws it closes, and what to check before and after you install it.

What is confirmed about the SonicOS security update

These points come from SonicWall's own notice and release notes, the CVE records and CISA:

• One advisory, seven flaws. SonicWall advisory SNWLID-2026-0014 covers Gen7 and Gen8 firewalls, both physical and virtual. SonicWall's notice went up on November 3, 2026 and was last updated on November 6. The seven CVE records were published on November 6.
• Affected versions. Gen7 on SonicOS 7.3.3-7015 or older and Gen8 on SonicOS 8.2.2-8015 or older.
• Fixed versions. For Gen7, SonicWall lists 7.3.4-7013 and above. For Gen8, it lists 8.2.3-8015.
• Exploited. CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog on November 6, 2026. US federal agencies must fix it by Friday, November 20. CISA lists ransomware use as "unknown".
• Gen6 is not covered. SonicWall says Gen6 and older firewalls are end-of-support and will not get these fixes.

What is not known: SecurityWeek reports that SonicWall said it had investigated a report of potential exploitation. Neither SonicWall nor CISA has said who is behind the attacks, how many firewalls were hit, or whether the attacks started before the fix was out. Only CVE-2026-19868 is on CISA's list. SonicWall has not reported attacks on the other six flaws.

Which SonicOS version fixes CVE-2026-19868

Why we recommend 7.3.4-7015 over 7.3.4-7013: 7013 came out in October, and its release notes do not label any fix as a security fix. They also say the NSv build "will not be released at this time". The 7.3.4-7015 release notes list NSv models and tie their security fixes to SNWLID-2026-0014. The 8.2.3-8015 notes do the same for Gen8.

Watch the Gen8 number. The Canadian Centre for Cyber Security's alert lists affected versions as "prior to 8.2.2-8015". SonicWall's own notice lists 8.2.2-8015 as affected and 8.2.3-8015 as the fix. Go by SonicWall: if your Gen8 firewall shows 8.2.2-8015, it still needs the update.

The six other SonicOS flaws in the same update

SonicWall's CVE records carry no severity scores. The scores below are the ones CISA added to each CVE record. SonicWall's notice rates the advisory as a whole at 8.8.

The two management interface flaws have the highest scores. CISA's scoring says they need user interaction, so the likely route is through someone who is using the admin page. SonicWall has not published details. Either way, a firewall admin page that anyone on the internet can reach is a bigger target than one that only staff can reach.

What changes when you upgrade to SonicOS 7.3.4 or 8.2.3

These come from SonicWall's release notes. They are the things most likely to cause trouble on the day:

• No way back. SonicWall says downgrading from 7.3.4 is not supported. Export a settings backup first.
• NSM 4.4 required. You need NSM SaaS or On-Premises 4.4 to manage 7.3.4 firewalls. GMS cannot manage firewalls on SonicOS 7.1 or later.
• API changes. On 7.3.4, bearer token authentication is on by default for API sessions outside the web interface, and CORS is off by default. Scripts or tools that talk to the firewall's API may stop working until you update them.
• GeoIP server change. If you pinned the old GeoIP server to 204.212.170.21, switch to default resolution or set 204.212.170.31. Botnet updates now have their own address setting, and SonicWall warns not to point it at .31.
• Certification. SonicOS 7.3.4 is not FIPS or Common Criteria certified. This matters if a contract or regulator requires either one.
• 8.2.3 known issue. Guest logins fail when you use a custom captive portal (GEN8-19712). SonicWall also notes that upgraded firewalls keep their existing login settings, so administrators have to turn on multi-factor authentication for the firewall themselves.

SonicWall update checklist for this week

1. Find every SonicWall firewall you own, including virtual NSv instances in the cloud. Write down the model and the SonicOS version shown in the management interface.
2. Export a settings backup before you upgrade, because 7.3.4 cannot be rolled back.
3. Check NSM and API integrations. Confirm that NSM is on 4.4. Ask whoever maintains scripts or monitoring that use the firewall API about the token and CORS changes.
4. Install 7.3.4-7015 on Gen7 or 8.2.3-8015 on Gen8, from MySonicWall.
5. Test the VPN afterwards. Sign in through SAML and confirm that the MFA prompt appears.
6. Review VPN logins. Look for users who signed in with a local or other non-SAML login when they should have used SAML. CVE-2026-19868 needs one of those logins to work, so remove the ones you don't need and change the passwords on the rest.
7. Take the admin page off the internet, or limit it to known addresses.
8. Gen6 owners: these devices will not be fixed. Budget for a replacement.

SonicOS update questions people are asking

Is SonicOS 7.3.4-7013 enough to fix CVE-2026-19868?

SonicWall lists 7.3.4-7013 and above as fixed for Gen7. We recommend 7.3.4-7015: it is newer, its release notes name the SNWLID-2026-0014 fixes, and it is the only 7.3.4 build released for NSv.

Do I need SonicOS 8.2.2-8015 or 8.2.3-8015?

8.2.3-8015. SonicWall lists 8.2.2-8015 as affected.

Is there a SonicWall workaround if I cannot update yet?

SecurityWeek reports that SonicWall said there is none. Updating is the fix.

Can I roll back SonicOS 7.3.4 if something breaks?

No. SonicWall says downgrading from 7.3.4 is not supported, so back up your settings and test in a quiet window.

Are Gen6 SonicWall firewalls affected?

SonicWall says Gen6 and older are end-of-support and are not covered by these fixes. It advises moving to Gen8 hardware.

Were the other six SonicOS flaws exploited?

No attacks have been reported. Only CVE-2026-19868 is on CISA's exploited list.

Why this matters for a company network

The firewall is the front door, and the SSL VPN is how staff get in from home or the road. If an attacker can get past SAML and MFA there, the extra security you paid for no longer protects that entry point. A rushed upgrade can do damage too: it can break VPN access, monitoring or guest Wi-Fi, and you cannot reverse it. A planned upgrade this week avoids both problems.

The bigger lesson

A firewall patch takes planning, testing and follow-up: you have to pick the right build, check what depends on the firewall and confirm the fix actually took. That is the point of Updated Is Not the Same as Patched, and the question in Who Is Patching the Software That Runs Your Business? is who owns that work at your company.

See how we lock down firewalls, VPNs and servers at /tech/security-hardening, or ask for help at /get-a-quote/tech.

Get security alerts like this by email, with our free checklist, at /security-alerts.

Sources: SonicWall: SonicOS 7.3.4 and 8.2.3 Security Advisory; SonicOS 7.3.4-7015 release notes; SonicOS 7.3.4-7013 release notes; SonicOS 8.2.3-8015 release notes; CISA KEV: CVE-2026-19868; CVE-2026-19868; CVE-2026-107154; CVE-2026-107155; CVE-2026-82308; CVE-2026-77708; CVE-2026-77709; CVE-2026-19703; Canadian Centre for Cyber Security AV26-1133; SecurityWeek.