Exploited SonicWall VPN flaw could let attackers in with just a stolen password

In many companies, two-factor authentication is the last line of defense when a password has been stolen. On November 6, SonicWall released a patch for a flaw that could bring down that defense on the VPN of its firewalls. The same day, CISA, the US cybersecurity agency, added it to its catalog of actively exploited vulnerabilities.

Tracked as CVE-2026-19868 and described in advisory SNWLID-2026-0014, the flaw affects the SSL VPN of SonicOS, the operating system of SonicWall firewalls. It only concerns devices whose VPN connections go through SAML, a protocol that hands authentication over to the company's identity provider, often to enforce a second factor. According to SonicWall, an attacker with valid credentials for another login method could bypass SAML controls, and potentially the two-factor authentication they enforce. The attacker therefore already needs a valid password, notes security firm Ostorlab.

The versions to install, since there is no workaround

• SonicOS 7 (Gen7 firewalls, physical appliances and NSv virtual machines): versions 7.3.3-7015 and earlier are affected, fixed in 7.3.4-7013.
• SonicOS 8 (Gen8 firewalls, physical appliances and NSv virtual machines): versions 8.2.2-8015 and earlier are affected, fixed in 8.2.3-8015.

SonicWall states that no workaround exists and urges customers to update “as soon as possible.” The vendor rates the flaw's severity at 7.1 out of 10. CISA, which considers that no prior privileges are required, scores it 7.5. US federal civilian agencies have until November 20 to patch.

The same advisory fixes six other SonicOS flaws. Two, rated 8.8, target the administration interface and could, under certain conditions, allow an unauthenticated attacker to perform unauthorized operations. Others are buffer overflows, exploitable before any authentication in the SSL VPN and in TACACS+, a service that controls administrative access. They could make the targeted service unavailable. The last one concerns overly weak password hashing on virtual machines.

Who is exploiting the flaw, and against whom?

For now, that is unknown. SonicWall only says it investigated a report of possible exploitation, without publishing details or indicators of compromise. The discovery is credited to Ryan Harris of The Electronic Office. The scenario is nothing exotic: Ostorlab describes a two-factor authentication bypass for a password that was stolen, reused or obtained some other way.

SonicWall devices are frequent targets: in October, exploitation attempts were already targeting a critical flaw in SMA1000 access gateways.

What to do?

Updating is the only real defense. The following checks, suggested notably by Ostorlab, help determine whether you have been targeted:

• check the installed version (command show version or System > Status menu);
• check whether SAML is enabled for SSL VPN connections. If it is not, this flaw does not apply, but the six others still need to be patched;
• list the accounts and login methods other than SAML accepted by the VPN, and remove those no longer needed. This reduces exposure but does not replace the update;
• search the VPN logs for successful logins by accounts supposed to use SAML but recorded with another method, then examine where they came from and which resources were accessed;
• if in doubt, reset the affected passwords and review the resources these accounts could access.

It remains to be seen whether SonicWall will publish details about the attacks observed. In the meantime, security teams can only look for anomalies, as there are no known traces to search for.