Multi-factor authentication only protects you if the system actually makes you use it. That is the lesson in the SonicWall flaw disclosed on November 6. A company can do the right thing \u2014 put its VPN behind SAML single sign-on and enforce MFA through it \u2014 and still have a side door that lets someone log in another way and never face the MFA prompt. SonicWall has patched it, CISA says it has already been exploited, and there is no workaround. If you run one of these firewalls, this is a patch-today job.<\/p>\n
The flaw is tracked as CVE-2026-19868, rated 7.1 out of 10 by SonicWall, and classified as CWE-308, use of single-factor authentication. It sits in the SSL VPN service in SonicOS, the operating system that runs SonicWall firewalls. SonicWall’s advisory, SNWLID-2026-0014, was published on November 6 and covers seven vulnerabilities in total. This one was reported by Ryan Harris of The Electronic Office.<\/p>\n
Here is how SonicWall itself describes it: an authentication enforcement vulnerability in the SonicOS SSL VPN service may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and successful exploitation may also bypass SAML-enforced multi-factor authentication. In plain terms, if the VPN is set up to use SAML for logins, but another login method also exists on that firewall, someone holding valid credentials for that other method could use them to get in without going through the SAML step \u2014 and without the MFA tied to it.<\/p>\n
Two limits matter. First, SonicWall says this only affects the SSL VPN service if SAML is enabled for SSL VPN logins. Second, the attacker needs valid credentials for an alternate method. This is not a no-password, anyone-on-the-internet bypass.<\/p>\n
On exploitation, the wording is careful but serious. SonicWall said its team “has investigated a report indicating potential exploitation” and strongly urged customers to upgrade as soon as possible. CISA went further the same day, adding the flaw to its Known Exploited Vulnerabilities catalog on November 6, with a remediation deadline of November 20 for federal agencies. SecurityWeek notes neither SonicWall nor CISA has shared details about the suspected attacks, and it is unclear whether it was exploited as a zero-day. No threat actor or victim has been publicly identified in the sources I read.<\/p>\n
For an affected firewall, I rate this high in practice, even though 7.1 is not the highest score you will see. The score reflects the preconditions \u2014 the attacker already needs a credential for another login method, and SAML has to be in use. What it buys them is exactly what MFA was bought to prevent: a stolen, shared, weak, or leftover password turning into remote access on its own. MFA is the layer that is supposed to make a stolen password not enough. A flaw that quietly removes it from your VPN \u2014 the front door for remote staff \u2014 is not a minor bug.<\/p>\n
At the same time, do not inflate it. It is not unauthenticated remote code execution, and it does not hand an attacker a shell. If you do not use SAML for SSL VPN logins, this flaw does not apply to you, by SonicWall’s own note. And an attacker still has to get an alternate-method credential first. The risk concentrates where passwords are reused, old accounts were never cleaned up, or a local login method was left enabled and forgotten \u2014 which, in my experience, describes more real networks than anyone likes to admit.<\/p>\n
The same upgrade also fixes the other six flaws in the advisory, two of them 8.8 issues in the management interface that, in certain circumstances, could let a remote attacker act without logging in. That is another reason not to sit on it.<\/p>\n
First, check whether you are affected. You need a Gen7 or Gen8 SonicWall \u2014 SecurityWeek lists Gen7 TZ, NSa, NSsp, and NSv, and Gen8 TZ, NSa, and NSv \u2014 running an old build, with SAML enabled for SSL VPN logins. The affected builds are SonicOS 7.3.3-7015 and earlier on Gen7, and 8.2.2-8015 and earlier on Gen8.<\/p>\n
Second, upgrade. The fixed releases are SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. SonicWall lists no workaround for this flaw, so there is no setting to toggle while you wait for a maintenance window \u2014 the upgrade is the fix. Do not treat November 20 as your deadline; that date binds federal agencies. It is a backstop, not a plan.<\/p>\n
Third, audit the alternate login paths. List every authentication method still enabled for that VPN, every local account, and every account not used in a long time. The flaw worked through an alternate method, so know what yours are. If an alternate-method password could have been reused, shared, or leaked, change it and review recent SSL VPN logins for sessions through a method or at a time you do not expect. I am not saying every affected site was breached \u2014 no source says that \u2014 I am saying a bypass of your login controls earns a look at the logs, not just a patch and a shrug.<\/p>\n
My bottom line: MFA you configured is not MFA you got if the box offers another way in. Patch the firewall today, then go count those other ways in.<\/p>\n
Sources: SonicWall advisory SNWLID-2026-0014, “SonicWall SonicOS Affected By Multiple Vulnerabilities” (November 6, 2026) \u2014 psirt.global.sonicwall.com\/vuln-detail\/SNWLID-2026-0014<\/a>; SecurityWeek, “SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins” (November 7, 2026) \u2014 securityweek.com\/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins<\/a>; BleepingComputer, “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks” (November 6, 2026) \u2014 bleepingcomputer.com\/news\/security\/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks<\/a>.<\/p>\n","protected":false},"excerpt":{"rendered":" Multi-factor authentication only protects you if the system actually makes you use it. That is the lesson in the SonicWall flaw disclosed on November 6. A company can do the right thing \u2014 put its VPN behind SAML single sign-on and enforce MFA through it \u2014 and still have a side door that lets someone […]<\/p>\n","protected":false},"author":1,"featured_media":0,"comment_status":"closed","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[8],"tags":[],"class_list":["post-182","post","type-post","status-publish","format-standard","hentry","category-security"],"_links":{"self":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/182","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/comments?post=182"}],"version-history":[{"count":1,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/182\/revisions"}],"predecessor-version":[{"id":183,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/posts\/182\/revisions\/183"}],"wp:attachment":[{"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/media?parent=182"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/categories?post=182"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/quentinpidcock.com\/content\/wp-json\/wp\/v2\/tags?post=182"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}