NexusSec.SSL VPN is the front door to most office networks, and MFA is the lock that makes a leaked password useless. This flaw quietly removes that lock. This post reflects what was published up to 12 November 2026.
What happened
SonicWall has released SonicOS updates that fix seven flaws in its Gen7 and Gen8 firewalls, physical and virtual. One of them, CVE-2026-19868, is in the SSL VPN service, and SonicWall said it had investigated a report of potential exploitation. On 6 November 2026, CISA added the flaw to its Known Exploited Vulnerabilities catalogue, which it does on evidence of active exploitation, and gave US federal agencies until 20 November to fix it.
No one has published details of the attacks. It is not known how many organisations were affected or what the attackers did once they were in.
Who is affected
- Gen7 firewalls on SonicOS 7.3.3-7015 or older.
- Gen8 firewalls on SonicOS 8.2.2-8015 or older.
- Only where SAML is turned on for SSL VPN logins.
This is not a way in without a password. The attacker needs valid credentials for another way of logging in to the SSL VPN. What the flaw removes is the protection added on top: the SAML sign-in and any MFA enforced through it. In plain terms, a stolen or guessed password can be enough again.
Gen6 firewalls are not listed as affected, but they are past end of support, and SonicWall advises moving to Gen8.
Why this one matters
Passwords leak all the time, through phishing, reuse and malware on home laptops. MFA is what makes a leaked VPN password useless, and this flaw takes it away. SonicWall SSL VPN has been here before. Help Net Security notes that an earlier SonicWall MFA bypass, CVE-2024-12802, was exploited, and that Akira ransomware affiliates broke into SonicWall SSL VPN accounts in 2025 even where one-time-password MFA was switched on. Our post on how the firewall became the way in covers the wider pattern.
What to do
This week
- Find out where you stand: whether SSL VPN uses SAML, and which SonicOS version every firewall runs, including standby units in high-availability pairs and branch firewalls.
- Upgrade: Gen7 to 7.3.4-7013 or later, Gen8 to 8.2.3-8015 or later. SonicWall lists no workaround, so the upgrade is the fix. The same release fixes six more SonicOS flaws, including two serious ones in the management interface, so upgrade even if you do not use SAML.
- If you cannot upgrade straight away, reduce exposure: limit which addresses can reach SSL VPN where your users connect from known places, and keep the management interface off the internet. Neither fixes the flaw. If the risk is too high to wait, switching SSL VPN off until you can upgrade is the only way to remove it.
After upgrading
- Compare VPN logins with your identity provider. Look for SSL VPN logins that succeeded without a matching sign-in and MFA check in Entra ID, Okta or whichever provider you use.
- Reset the password of any account that logged in that way, and check what those sessions reached.
- Remove logins you do not need. SonicWall has not said which other login method the attack uses, so the fewer ways there are to sign in to SSL VPN, such as local firewall accounts or old LDAP and RADIUS logins, the smaller the gap.
- Keep enough logs. If your firewall only keeps a few days of logs, step 1 has nothing to check. CERT-In expects 180 days; see CERT-In's 180-day log rule.
If you are still on Gen6
It no longer gets fixes, so plan the replacement now rather than after the next flaw. Our firewall replacement checklist covers how to do it without a bad Monday, and it is a good moment to ask whether VPN or ZTNA suits your remote access better.
Sources
- CISA: CISA adds one known exploited vulnerability to catalog, 6 November 2026
- BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks, 6 November 2026
- Help Net Security: Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA, 9 November 2026
- SonicWall PSIRT: advisory SNWLID-2026-0014, November 2026
