SonicWall MFA bypass flaw is being exploited, CISA confirms — patch by Nov 20
SonicWall fixed a flaw that lets an attacker bypass SAML login controls — including multi-factor authentication — on its SSL-VPN, and CISA confirmed it is already being exploited in the wild.
📊 Scorecard: our Bearish call on $CRWD is scored from $216.90, the last close before it ran. Its first result comes after the next close.
The News
SonicWall released security updates on November 6 fixing seven vulnerabilities in its SonicOS firewalls, including a flaw that lets an attacker bypass the login protections many companies rely on most. The flaw, CVE-2026-19868, sits in SonicWall’s SSL-VPN — the remote-access doorway employees use to reach office systems from home. It carries a severity score of 7.1 out of 10. An attacker who already holds valid credentials for an alternate login method can use the flaw to sidestep SAML authentication controls — including multi-factor authentication enforced through SAML — on SSL-VPN services set up to use SAML.
What makes this one different from a routine patch is the confirmation that attackers are already using it. SonicWall’s security team said it investigated a report indicating potential exploitation and urged customers to upgrade immediately. The same day, CISA — the US Cybersecurity and Infrastructure Security Agency — added the flaw to its Known Exploited Vulnerabilities catalog, confirming exploitation in the wild, and ordered federal civilian agencies to patch by November 20, 2026. Canada’s cyber centre issued a matching advisory. The flaw was reported by Ryan Harris of The Electronic Office.
The fix is available now, and there is no workaround. Affected systems are SonicOS Gen7 version 7.3.3-7015 and earlier, and Gen8 version 8.2.2-8015 and earlier; the fixed versions are 7.3.4-7013 and 8.2.3-8015 or later. The same update fixes six more flaws, including two rated 8.8 that affect the firewall’s management interface and a pre-authentication heap buffer overflow in SSL-VPN rated 7.5. No threat actor, victim count or attack details have been published, and SonicWall has not blamed any group.
A stolen password was never supposed to be enough. This flaw makes it enough.
Why It Matters
Multi-factor authentication is the single most widely recommended defence in cybersecurity — the extra check, usually a code on your phone, that is supposed to stop a stolen password from becoming a break-in. A flaw that lets an attacker walk around it, even one who needs valid credentials first, undermines the control companies count on most. That is why CISA’s catalog matters: it is reserved for flaws confirmed as exploited, and once a flaw lands there, federal agencies get a hard deadline. Private companies usually follow the same clock.
It matters for the security stocks because the pattern keeps repeating: a widely used piece of network equipment turns out to have a hole, and the vendors that sell detection and response — CrowdStrike and Palo Alto Networks — are the read-through. SonicWall itself is private, so there is no stock to trade on the news directly. But every exploited VPN flaw is a reminder of why companies pay for monitoring and incident response, and also a reminder that the defensive side is always playing catch-up. On November 6, the market gave the group no credit: CrowdStrike closed at $216.90, down 0.14%, and Palo Alto Networks at $313.84, down 0.26%.
Analyst's Take
Our call is Bearish. An exploited flaw in a major VPN product, with no workaround and a federal patch deadline, is bad news on its own terms — and the detail that should worry defenders most is that the bypass needs only valid credentials for an alternate login method. Stolen credentials are the most common way into a network; a flaw that turns them into a full multi-factor bypass is a force multiplier for every credential-theft campaign already running.
The honest caveat is that no victim count, no named attacker and no attack details have been published, so the scale of the damage is still unknown. But CISA does not add a flaw to its exploited catalog on a rumour, and the patch-by-November-20 order tells you how seriously the US government takes it. Watch the patch rate: the risk now is not the flaw itself but the firewalls that stay unpatched past the deadline.
Are you bullish or bearish on this story?
By The Numbers
FAQ
What is SAML, in plain terms?
A login standard that lets employees sign in once and get into many company systems. When a company says its VPN “uses SAML,” it means that single sign-in — including its multi-factor check — is the gate.
What is multi-factor authentication (MFA)?
A second proof of identity after your password, usually a code from an app or your phone. It is meant to stop a stolen password from being enough on its own.
What is CISA’s Known Exploited Vulnerabilities catalog?
A US government list of flaws confirmed as exploited in real attacks. Federal civilian agencies must patch listed flaws by the stated deadline — here, November 20, 2026.
Which SonicWall versions are affected?
SonicOS Gen7 version 7.3.3-7015 and earlier, and Gen8 version 8.2.2-8015 and earlier. The fix is 7.3.4-7013 and 8.2.3-8015 or later, and there is no workaround.
Who is behind the attacks?
No one has been named. SonicWall has not attributed the exploitation to any group, and no victim count or attack details have been published.
👁
Source: BleepingComputer