SonicWall SSL-VPN flaw can bypass MFA: what to do now
CISA says attackers are exploiting a SonicOS flaw that can get past SAML logins and MFA on the VPN. Here is who is affected and what to do this week.
If your office firewall is a SonicWall and your staff connect through its SSL-VPN, this one needs attention now. On November 6, 2026, SonicWall published fixes for seven SonicOS vulnerabilities, and the same day the U.S. Cybersecurity and Infrastructure Security Agency (CISA) added one of them, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog. That listing means CISA has evidence of real-world attacks. Federal agencies have until November 20 to fix it. Your business isn't bound by that date, but it's a sensible outer limit.
What happened
According to BleepingComputer, the flaw lets an attacker who holds valid credentials for an alternate login method get past SAML authentication on the SSL-VPN, potentially including the multi-factor check that SAML enforces. It is rated 7.1 out of 10 and only affects SSL-VPN services set up to use SAML logins. SonicWall's own wording is more cautious: it says it investigated a report of potential exploitation, and it has not shared details of the attacks.
In plain terms, a stolen or old VPN password could be enough, even if you believed every VPN login also needed a code from a phone. That is why a medium-looking score still matters. Many small firms added single sign-on and MFA to their VPN precisely so that a leaked password alone wouldn't let anyone in.
The same release fixes six other problems, including two management interface flaws rated 8.8 that don't need a login, and buffer overflows in the SSL-VPN and TACACS+ services that could knock those services offline.
Are you affected?
The SonicWall notice lists these versions, for physical and virtual firewalls:
- Gen 7: SonicOS 7.3.3-7015 and older are affected. Move to 7.3.4-7013 or later. Build 7.3.4-7015 was released on November 5.
- Gen 8: SonicOS 8.2.2-8015 and older are affected. Move to 8.2.3-8015.
- Gen 6 and older: these models are past end of support and get no firmware fixes. SonicWall's advice is to replace them.
SonicWall says no workarounds are available, so updating is the fix.
What your business should do this week
- Find out what you have. Note the firewall model and SonicOS version, and whether the SSL-VPN uses SAML. If an outside company manages your firewall, ask them directly and get the answer in writing.
- Export the configuration, then update. A firmware update restarts the firewall, which takes your internet and VPN down briefly, so pick a quiet time and make sure someone can reach the device if it doesn't come back cleanly.
- Clean up VPN accounts. Remove accounts for former staff and vendors, and any local accounts nobody uses. Change passwords on the ones you keep, especially if they are reused elsewhere.
- Read the logs. Look for VPN logins at odd hours, from unexpected countries, or from accounts that should be idle. Save anything suspicious before you change it.
- Keep the management interface off the internet. With two serious flaws in that area, limit firewall administration to your internal network or a short list of trusted addresses.
Updating closes the hole, but it doesn't remove an intruder who got in earlier. If the logs look wrong, treat it as a possible incident rather than a tidy-up job.
The wider lesson
A firewall is the one device every business assumes is safe and rarely updates. Put it on the same schedule as your computers, with someone named as responsible. Our patch management service covers that kind of routine, and network setup and management includes firewalls and VPN access.
Not sure which firmware you're running, or whether your VPN logs look normal? Call (213) 986-4855 or see our cybersecurity page.