Multi-factor authentication (MFA) is one of the best defences a business can have. It is also easy to assume it covers every login when it does not. A flaw in SonicWall firewalls, now exploited in attacks, shows how a second, forgotten way of signing in can let attackers skip MFA altogether.
If your staff connect to the office through a SonicWall SSL VPN, this is worth checking today. And even if you use other equipment, the lesson applies to every remote access system you run.
What SonicWall disclosed
On 6 November, SonicWall published an advisory covering seven SonicOS vulnerabilities. The most urgent is CVE-2026-19868, a flaw in the SSL VPN service rated 7.1 (high).
In SonicWall's words, it may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and "may also bypass SAML-enforced multi-factor authentication". In plain terms: if your VPN sends users to an identity provider such as Microsoft Entra ID or Okta for sign-in and MFA, someone holding a working password for another login method on the same firewall may be able to get in without going through that check.
The flaw only affects firewalls where SAML is enabled for SSL VPN logins. SonicWall says it has investigated a report of potential exploitation, and the US Cybersecurity and Infrastructure Security Agency (CISA) added the flaw to its catalogue of known exploited vulnerabilities on the same day. Neither has shared details of the attacks, and, as SecurityWeek notes, it is not yet clear whether the flaw was exploited before the fix was available. We are not aware of any reported cases in the UAE or GCC.
Which firewalls are affected
- Gen7 TZ, NSa, NSsp and NSv: affected on SonicOS 7.3.3-7015 and older; fixed in 7.3.4-7013 or later.
- Gen8 TZ, NSa and NSv: affected on SonicOS 8.2.2-8015 and older; fixed in 8.2.3-8015 or later.
There is no workaround, so upgrading is the only fix. The same update closes six other flaws, including two rated 8.8 in the SonicOS management interface that could, under certain conditions, let a remote attacker carry out actions without logging in, and three that could be used to crash the VPN or authentication services. None of those six is reported as exploited.
The real lesson: MFA only protects the doors it guards
Most businesses add MFA to their main login and consider the job done. But remote access systems often have more than one way in:
- Local accounts created on the firewall during setup or for a supplier, protected only by a password.
- Older directory logins such as LDAP or RADIUS, kept "just in case" after a move to single sign-on.
- Service and test accounts that nobody remembers creating.
Each of these is a side door. If it accepts a password without MFA, then an attacker with a stolen or guessed password can use it, and a flaw like CVE-2026-19868 can make that side door work even when you thought every login went through MFA.
What UAE and GCC organisations should do now
- Upgrade SonicOS. Move Gen7 firewalls to 7.3.4-7013 or later and Gen8 to 8.2.3-8015 or later, starting with any that use SAML for SSL VPN.
- Check your VPN logs for logins that skipped MFA. Compare successful SSL VPN logins with sign-ins recorded by your identity provider. A VPN session with no matching identity provider sign-in deserves investigation.
- Remove login methods you do not need. Disable unused local accounts and older authentication methods on the firewall, so SAML with MFA is the only route in for staff.
- Reset credentials if anything looks wrong. If you find unexplained logins, reset the affected passwords, end active sessions and review what those accounts accessed.
- Lock down the management interface. Keep firewall administration off the internet and limited to a management network or VPN. Edge devices are a favourite target, as we explained in Your Network Edge Is the Target.
- List every remote access path. Include VPNs, remote desktop gateways, supplier remote support tools and cloud admin portals, and confirm each one enforces MFA with no exceptions.
- Move to phishing-resistant MFA where you can. Passkeys and security keys are much harder to steal than passwords and text-message codes.
Check the side doors
MFA remains essential. This flaw does not make it less valuable; it shows that MFA is only as strong as the login paths that enforce it. A short review of how people can actually reach your network, and closing the routes nobody uses, will do more for your security than any single product.
COMMPRO Technologies supplies firewalls, secure remote access and identity solutions from leading vendors across the UAE and GCC. If you would like help reviewing your VPN and remote access setup, contact our team.
