If your office VPN runs on a SonicWall, check it this week

If your staff connect to the office through a SonicWall firewall's SSL VPN, it needs a firmware update. SonicWall published a flaw yesterday that can let someone get past the SAML login, and the multi-factor check that goes with it.

The same day, CISA (the US government's cyber security agency) added it to its list of flaws known to be used in real attacks. That's the bit that makes it a this-week job rather than a sometime job.

What happened

The flaw is CVE-2026-19868. SonicWall's own description says a user with valid credentials for "an alternate authentication method" can "bypass SAML authentication controls". It goes on to say this "may also bypass SAML-enforced multi-factor authentication (MFA)".

SAML is the standard behind most "sign in with your company account" logins. If your VPN sends people off to sign in that way, with a code or an app prompt on their phone, that's the protection in question.

My reading of the description is this. If the VPN will also accept some other kind of login (a local account set up on the firewall itself, for example), someone who has that password may be able to skip the SAML sign-in, and the MFA along with it. SonicWall hasn't published the detail behind that, so treat it as my plain-English version, not theirs.

CISA added it to its Known Exploited Vulnerabilities catalog on 6 November, with a 20 November deadline for US federal agencies. CISA lists ransomware use as "Unknown". It doesn't say who's being attacked or how, and I haven't seen anything public that does.

SonicWall's advisory is SNWLID-2026-0014. It needs JavaScript to load, so if it comes up blank, try it in a normal browser.

Does it affect you?

The CVE record lists two families of firmware:

• Gen7: SonicOS 7.3.3-7015 and older
• Gen8: SonicOS 8.2.2-8015 and older

It's about the SSL VPN service and SAML logins. If you've never switched the SSL VPN on, or your VPN doesn't use SAML, this particular flaw shouldn't be your problem. You'll still want the update, because it's a firewall and it faces the internet.

The record doesn't mention Gen6, so I can't tell you either way. If you have an older box, check the advisory or ask SonicWall support.

A lot of small offices have a firewall that was put in years ago by someone who's since moved on. If you're not sure what's in your comms cupboard, that's worth finding out now, whatever the answer turns out to be.

What to do this week

1. Find out what you've got. Log in to the firewall's admin page and note the model and firmware version. If nobody knows the admin password, that's a finding in itself, and it's worth fixing before the next flaw comes along.

2. Check whether SSL VPN and SAML are in use. If the SSL VPN is switched on but nobody uses it, turn it off. The less you have facing the internet, the better.

3. Update the firmware. You want a release newer than the affected versions above. Check SonicWall's advisory for the exact fixed release for your model. Before you start, export a copy of the firewall's settings and keep it somewhere safe. Do it outside working hours, because the firewall restarts and everyone's internet goes with it.

4. Tidy up the other logins. Go through the VPN users and look for local accounts on the firewall. Remove the ones nobody needs. Change the passwords on the rest, especially any that were set years ago or shared between people. If my reading is right, those are the accounts that matter here.

5. Look at recent VPN logins. Check the firewall's logs for VPN connections from names you don't recognise, at odd times, or from places your staff don't go. If something doesn't look right, don't wipe it. Keep the logs as they are and get it looked at.

The VPN shouldn't be the only lock

Often the VPN is there so staff can reach one thing: an in-house database, a booking system, an old line-of-business app. If the VPN is the only thing checking who's allowed in, a flaw like this one leaves that system with nothing behind it.

The app itself should check who you are and what you're allowed to see. The team at Dev Partners wrote about missing access controls and why it's the thing they find "every single time" they review an AI-built app. If you've got an in-house system like that and nobody looking after it, they also support and maintain existing software month to month.

The bigger point

This is the same lesson as the OpenSSH long password bug yesterday. You can have a good front door with MFA on it, and still have a side door you forgot was there. MFA is only as strong as every other way in.

If you've got a firewall, a VPN and a couple of servers and nobody's quite sure how they fit together, I can go through it with you, write down what's there, and tell you in plain English what to change.