Daily · Article 01 · 3 min read
- Security
SonicWall remote access flaw is known to be exploited
November 7 JST reporting window · CISA entry dated November 6 · checked November 8 JST
Summary
Valid credentials for another sign-in method can bypass the company’s sign-in checks and may bypass extra verification. The fixed build depends on the firewall generation.
When someone working from home opens a company file, the firewall’s remote access service connects them to the office network. The protection on that connection depends on which sign-in checks the firewall requires.
Key facts
The U.S. Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868, a SonicWall firewall flaw, to its November 6 catalog of vulnerabilities known to be exploited. SonicWall says someone with valid credentials for an alternate sign-in method may bypass the company’s SAML sign-in checks, potentially including the extra verification enforced through that route. The flaw affects certain SonicOS versions on Gen 7 and Gen 8 firewalls. CISA catalog · SonicWall’s CVE record
1. How another sign-in route changes the check
An SSL VPN gives people outside the office a route into its network. SAML is how the company sign-in service tells the firewall it has verified a person. For example, that service might ask for a password and a phone approval. The phone approval is the extra verification step. If the firewall accepts valid credentials through another method and skips the SAML check, it may also skip the phone approval. The comparison simplifies the conditions SonicWall described.
| Sign-in route | What is checked | Result |
|---|---|---|
| Normal route | Phone approval at the company sign-in service | Firewall receives SAML confirmation and permits access |
| Vulnerable case | Valid credentials for another method | SAML and its extra verification may be skipped |
- Sign-in route
Normal route
- What is checked
- Phone approval at the company sign-in service
- Result
- Firewall receives SAML confirmation and permits access
- Sign-in route
Vulnerable case
- What is checked
- Valid credentials for another method
- Result
- SAML and its extra verification may be skipped
The cat asks Q&A
The researcherIf my company sign-in already asks for phone approval, what else should I check?
Pocket NotebookCheck which sign-in methods your firewall allows for the SSL VPN. The extra check on the company sign-in service protects connections that go through that step.
2. Which version is running on our firewall?
SonicOS is the software running on the firewall. The operator can identify the device generation first and then compare its running version with the matching row. SonicWall lists affected and fixed versions in its notice and documents the Gen 8 build in the release notes. SonicWall version notice · Gen 8 release notes
| Device generation | Affected versions | Vendor notice · fixed build listed | Installation · operator check |
|---|---|---|---|
| Gen 7 | 7.3.3-7015 and older | 7.3.4-7013 or later | Read the running version on the device |
| Gen 8 | 8.2.2-8015 and older | 8.2.3-8015 | Read the running version on the device |
- Device generation
Gen 7
- Affected versions
- 7.3.3-7015 and older
- Vendor notice · fixed build listed
- 7.3.4-7013 or later
- Installation · operator check
- Read the running version on the device
- Device generation
Gen 8
- Affected versions
- 8.2.2-8015 and older
- Vendor notice · fixed build listed
- 8.2.3-8015
- Installation · operator check
- Read the running version on the device
The cat asks Q&A
- The researcher
Does downloading the update finish the job?
Pocket NotebookCheck that the fixed version is running on the firewall. Check the standby device too if you have one, and record when the change took effect.
3. Checking the fix and earlier connections
Installing the fixed version closes this bypass going forward. Earlier connections are a separate question. CISA records known exploitation, but the catalog entry does not list affected devices or accounts used in attacks. The operator can compare VPN access records from the firewall with authentication records from the company sign-in service. Start with the account and time of any suspicious connection.
| Time to check | What the operator checks | Question it answers |
|---|---|---|
| Now | Running firewall version | Is the fixed build running? |
| Before the fix | VPN and company sign-in records | Which earlier connections need a closer look? |
- Time to check
Now
- What the operator checks
- Running firewall version
- Question it answers
- Is the fixed build running?
- Time to check
Before the fix
- What the operator checks
- VPN and company sign-in records
- Question it answers
- Which earlier connections need a closer look?
The cat asks Q&A
- The researcher
A VPN connection has no matching company sign-in. Is that proof of an intrusion?
Pocket NotebookIt is a lead to investigate. Check the time zones and retention periods of both records, and which sign-in methods that account could use.
To close
Two checks for the operations team
If your organization uses a SonicWall firewall for remote access, ask the operator for the running version and whether they have reviewed connections made before the fix.
Sources
- CISA catalogcisa.gov
- SonicWall’s CVE recordcveawg.mitre.org
- SonicWall version noticesonicwall.com
- Gen 8 release notessonicwall.com