If your office firewall is a SonicWall, it needs an update this week.
Lots of small businesses use SonicWall boxes to connect to the internet and let staff work from home. A flaw fixed on Friday, November 6, lets someone who already has a staff password skip the code-on-your-phone sign-in step on some setups. The US government's cyber agency (CISA) says it's being used in real attacks.
What happened
SonicWall released updates to SonicOS, the software that runs its firewalls. A firewall is the box between your office network and the internet that decides what gets in and out. The main fix is for a flaw tracked as CVE-2026-19868 (a CVE is the industry's tracking number for a security bug).
SonicWall said it looked into a report that the flaw might be in use, but hasn't shared details. CISA added it to its list of flaws known to be used in real attacks on November 6 and told US federal agencies to fix it by November 20. Canada's cyber agency, the Canadian Centre for Cyber Security, put out its own advisory the same day.
SonicWall says there's no workaround. The fix is to update. The same update also fixes six other SonicOS flaws, including two rated 8.8 out of 10 in the firewall's management screens. Those six aren't known to be in use.
What this means in plain English
Many businesses let staff connect from home through the firewall's VPN, a secure tunnel into the office network. Some set it up so staff sign in through a central login service, like their Microsoft account, which also asks for the code on their phone. That arrangement goes by the technical name SAML.
The flaw is a side door. If someone has a valid password for a different way into the VPN, they can get past that central sign-in, and the phone-code step that comes with it. It's like a building where the front entrance needs your badge plus a PIN from security, but a side entrance takes the badge alone.
They still need a real password. But passwords leak all the time through phishing and reused logins. The phone code is what's supposed to stop a stolen password from being enough.
Why a small business should care
Your VPN is a direct line into your office network. If someone gets through it as a staff member, they can reach whatever that person can reach. For a manufacturer, that can mean file servers, accounting and the systems on the shop floor.
Firewalls get forgotten because they sit in a closet and just work. That's exactly why they're attractive targets.
Who's affected
SonicWall Gen7 and Gen8 firewalls, physical and virtual, running SonicOS 7.3.3-7015 or older, or 8.2.2-8015 or older
Only if the VPN uses that central sign-in (SAML)
Fixed versions: SonicOS 7.3.4-7013 or later, and 8.2.3-8015
Older Gen6 firewalls aren't listed for this flaw, but they're past end of support. SonicWall recommends moving to Gen8.
What to do: everyone
If you work from home through the office VPN and get an unexpected phone-code request, or a sign-in alert you didn't trigger, tell your IT person right away.
Don't reuse your work password anywhere else.
What to do: if you run the business
Find out if you have a SonicWall and who looks after it.
Get it updated to SonicOS 7.3.4-7013 or 8.2.3-8015, even if you're not sure the phone-code setup applies to you. The update fixes six other flaws too.
If you're on a Gen6 box, budget for a replacement. It isn't getting fixes any more.
Questions to ask your IT provider
What version of SonicOS is our firewall on today?
Does our VPN use central sign-in (SAML) with phone codes?
Have you checked recent VPN logins for any that got in without the phone-code step? If so, have those passwords been reset?
When was the firewall last updated before this, and how will we know about the next one?
Sources
BleepingComputer: SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
Help Net Security: Exploited SonicWall SSL-VPN flaw lets attackers bypass SAML-enforced MFA (CVE-2026-19868)
The Hacker News: CISA Flags SonicWall SonicOS MFA Bypass Flaw Amid Reports of Possible Exploitation
Canadian Centre for Cyber Security: SonicWall security advisory (AV26-1133)
Contact Nautalex to see how we can help you with keeping your firewall up to date.
