SonicWall SSL VPN flaw under attack: check your MFA login

The US cybersecurity agency CISA said on 6 November 2026 that attackers are using a flaw in the SSL VPN of SonicWall firewalls (CVE-2026-19868). Someone who already has a working username and password can log in without passing the SAML single sign-on and two-step check. If your office VPN runs on a SonicWall firewall, ask your IT vendor to apply SonicWall's fix this week.

What is the problem?

Many offices use the SSL VPN on a SonicWall firewall so staff can reach office files from home. Some also connect the VPN to a SAML login, such as Microsoft or Google sign-in, so that every login needs a second step on the phone.

CISA says the flaw lets a user with valid credentials for another login method get around those SAML controls, and with them the two-step check. In plain words, a stolen or guessed VPN password may be enough to get in, even where you thought two-step login protected you. CISA lists it among the holes attackers are using now and has set US government agencies a deadline of 20 November 2026 to fix it.

Who needs to act?

• Offices whose VPN runs on a SonicWall firewall (SonicOS SSL VPN).
• Most of all, offices that rely on SAML sign-in with two-step login to protect that VPN.

If you do not know what firewall your office has, the brand is usually printed on the front of the box, or your IT vendor will know.

What to do

1. Ask your IT vendor to check SonicWall's advisory SNWLID-2026-0014 and install the fixed SonicOS version for your model as soon as possible.
2. Until it is updated, turn off any extra login methods on the VPN that you do not use, so SAML with two-step login is the only way in.
3. Review the list of VPN accounts. Remove old staff and test accounts, and reset passwords for accounts you are unsure about.
4. Ask your vendor to look at the VPN login records for sign-ins from unusual countries or at odd hours.
5. If anything looks wrong, change all VPN passwords after the update and tell staff not to reuse them anywhere else.

How SyncTech can help

Not sure who looks after your office firewall or whether it has been updated? Contact our support team and we will help you find out what you have and who should fix it.

Source and credit

We are sharing this news from CISA and SonicWall. This summary is written by Synctech in our own words.

• Known Exploited Vulnerabilities Catalog, CVE-2026-19868, CISA, 6 November 2026: https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• SonicWall security advisory SNWLID-2026-0014: https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014

Retrieved 7 November 2026. SonicWall and SonicOS are trademarks of SonicWall Inc. Microsoft and Google are trademarks of their owners. Synctech is not connected with them. This is general information, not legal, tax or financial advice. If anything here is wrong, email support@synctech.com.my and we will correct it.