I will update this story if SonicWall or CISA release new details.

◢What happened

Many companies use the VPN built into their SonicWall firewall so staff can reach the office network from home or on the road. When that VPN is protected with SAML, sign-in goes through the company's identity provider (Microsoft's or Google's, for example), which is usually where multi-factor authentication lives.

The problem, according to the vendor's own description as quoted by The Hacker News, is that a user with valid credentials for an alternate authentication method can bypass SAML authentication controls. If MFA was enforced through SAML, it can be bypassed too. CISA classifies the flaw as use of single-factor authentication (CWE-308): in practice, a password alone may be enough where the company thought something more was required.

It is rated high severity, with scores of 7.1 and 7.5 out of 10 according to The Hacker News. This is not a flaw that lets anyone in with nothing: the attacker needs a valid credential. But stolen and leaked passwords are everywhere, and MFA exists precisely so that a password on its own is not enough.

◢Is it being exploited?

SonicWall acknowledges, as reported by The Hacker News, that it investigated a report indicating potential exploitation of the flaw, and it urges customers to update to the latest version as soon as possible. It has not shared any further details about the attacks or who is behind them.

CISA has added it to the exploited vulnerabilities catalog and given US federal agencies until November 20 to fix it. Its entry lists use in ransomware campaigns as unknown. No official source has attributed these attacks to any group or country.

◢The other flaws fixed in the update

The same batch of patches closes several other high-severity SonicOS vulnerabilities. According to The Hacker News, two are in the management interface (CVE-2026-107155 and CVE-2026-107154, rated 8.8 out of 10) and could let a remote attacker without credentials perform unauthorized operations under specific conditions. A third, CVE-2026-82308, is a heap overflow in the SSL-VPN that can be triggered without logging in and could knock the service offline.

A few days earlier, SonicWall had also warned about two unpatched flaws in its older GMS management console, which is no longer supported, and advised customers to move to Network Security Manager (NSM).

◢Is my company affected?

If you are not sure which firewall you have, ask whoever runs your IT, or the provider that maintains your network, today. In many small businesses the firewall was set up years ago and nobody has looked at it since, and that is exactly the kind of device attackers go looking for.

◢What to do now

CISA's deadline only binds the US federal government, but it gives a sense of urgency: under two weeks. For the technical team, the sensible steps are:

• ▹Update SonicOS to the fixed version that SonicWall's advisory lists for your model.
• ▹Check which other authentication methods the VPN accepts besides SAML (local firewall users, LDAP or others) and remove the ones you do not need. The flaw abuses exactly those alternate paths.
• ▹Change the passwords of accounts that sign in through those other methods. If one has leaked, the patch closes the door but the password would still work.
• ▹Review the VPN connection logs from the last few days for anything unusual: odd hours, countries where you have no staff, users who rarely connect.
• ▹Do not leave the firewall's management interface reachable from the internet. Two of the fixed flaws live there.

For management, the useful question is who receives the firewall vendor's security advisories and how long it takes to apply them. If the answer is "I don't know", there is work to do.

◢What to learn from this

Just over a week ago I wrote about the exploited flaws in Ivanti's VPN. It is the same pattern: a VPN is exposed to the internet by design, and it is one of the first things attackers probe.

The other lesson is about multi-factor authentication. It is still one of the best things a company can do, but you need to check that it really applies to every way in. If a side door only asks for a password, that is where the attacker will go. And since many attacks start by stealing credentials with a well-crafted email, staff who can spot the trick remain the first line of defence.

If you want your team to understand why this matters without having to be technical, that is what I work on in my cybersecurity training.