SonicWall VPN Flaw Lets Attackers Skip MFA With Just a Password — Patch Your Firewall Now

If your team connects to the office through a SonicWall VPN, the MFA prompt you rely on may not be stopping a stolen password. On Friday, November 6, SonicWall released updates for seven SonicOS firewall vulnerabilities and warned that one of them, CVE-2026-19868, may have been exploited in an attack. CISA added it to its Known Exploited Vulnerabilities catalog the same day, which confirms exploitation in the wild.

• What it does: someone with valid credentials for another login method can bypass SAML sign-in controls on the SSL-VPN, and that can include SAML-enforced multi-factor authentication (MFA).
• Who is affected: only SSL-VPNs that have SAML login turned on, on Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running 8.2.2-8015 or older.
• The fix: SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8). SonicWall says there is no workaround.

Why it matters for your money

Help Net Security explains what this means in practice: a VPN login that should have gone through your identity provider (such as Microsoft Entra ID or Okta) and its MFA check can succeed with a password alone. Attackers still need a working password first. But stolen VPN passwords are easy to find, and MFA is the control most small offices count on to make them useless.

SonicWall VPNs have been a favorite way in for ransomware crews. Help Net Security notes that in 2025, Akira ransomware affiliates broke into SonicWall firewalls even with one-time-code MFA turned on. Earlier this year attackers also exploited a different SonicWall SSL-VPN MFA bypass. Neither SonicWall nor CISA has said yet how many organizations were hit or what the attackers did after getting in. For a small business, one VPN break-in can mean locked files, days of downtime and a ransom demand.

What to do this week

1. Check your firewall's firmware version. If it is a Gen7 or Gen8 SonicWall with SAML login turned on for SSL-VPN, schedule the update to 7.3.4-7013 or 8.2.3-8015 as soon as you can. Plan for a short reboot after hours.
2. Review recent VPN logins. Look for SSL-VPN sessions that succeeded but have no matching sign-in and MFA check in your identity provider's logs (Entra ID, Okta, etc.).
3. Reset passwords for any account that logged in that way, and check what those sessions accessed.
4. Remove VPN accounts nobody uses, like former employees, old vendor logins and test users.
5. Still on a Gen6 or older SonicWall? Those models are past end of support. SonicWall recommends moving to a Gen8 firewall, so put the replacement in your budget.

For South Texas offices: if a vendor installed your firewall years ago and nobody has logged into it since, now is the time to find out what firmware it runs. For remote-managed clients nationwide: ask your MSP to confirm in writing that the patch is installed and the VPN log review is done.

Nice2GeekYou is based in San Antonio and serves all of Texas on site, and our managed IT plans cover remote clients across the U.S. We patch and monitor business firewalls, lock down remote access, and replace end-of-life gear before it becomes a break-in point. Request a quote, see our monthly plans, or text us at (210) 504-8969.

Sources: BleepingComputer — SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks; SecurityWeek — SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins; Help Net Security — Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868) (November 9, 2026); SonicWall advisory SNWLID-2026-0014 (November 6, 2026).