If your business uses a SonicWall firewall for remote access, stop and check your SonicOS version today. On 6 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added a new vulnerability to its Known Exploited Vulnerabilities (KEV) catalog: CVE-2026-19868, a flaw in SonicWall's SSL-VPN that lets attackers bypass multi-factor authentication. This is not a theoretical risk — CISA confirmed it is already being exploited in the wild.
What exactly is broken
SonicWall firewalls are widely used by small and medium-sized businesses across Switzerland for secure remote access, letting employees log into company networks from home or on the road. According to SonicWall's advisory SNWLID-2026-0014, the vulnerability affects SonicOS SSL-VPN services configured to use SAML authentication. Attackers who already hold valid credentials for an alternate login method can exploit the flaw to bypass SAML-enforced MFA entirely — meaning the extra security layer your business relies on simply doesn't stop them.
The vulnerability has a CVSS severity score of 7.1, which is considered high risk. It affects Gen7 SonicOS versions 7.3.3-7015 and earlier, and Gen8 versions 8.2.2-8015 and earlier.
Why "patch later" isn't an option here
Unlike many vulnerabilities, there is no workaround for this one. SonicWall has stated plainly that upgrading SonicOS is the only mitigation available. The fixed versions are SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8).
CISA's Binding Operational Directive 26-04 requires US federal agencies to remediate this specific flaw by 20 November 2026 because of its severity and active exploitation. CISA explicitly encourages all organizations, not just government bodies, to adopt the same urgency. If a government deadline of two weeks sounds tight for a federal agency with dedicated IT security staff, think about what it means for a Swiss SME without one.
What to do today
- Check your SonicOS version. If your firewall uses SSL-VPN with SAML authentication and runs Gen7 7.3.3-7015 or earlier, or Gen8 8.2.2-8015 or earlier, it is vulnerable.
- Upgrade immediately. Install SonicOS 7.3.4-7013 (Gen7) or 8.2.3-8015 (Gen8) as soon as possible — do not wait for a scheduled maintenance window.
- Review VPN login activity. Look for unusual login patterns, logins from unexpected locations, or authentication attempts that skip the usual MFA prompt.
- Rotate credentials for accounts that use SAML-based SSL-VPN access, especially for any administrator or privileged accounts.
- Don't assume MFA alone protects you. This flaw is a reminder that even strong authentication controls can have gaps at the implementation level, not just the user level.
The bigger picture
This is the second SonicWall-related SSL-VPN security issue to make headlines in recent memory, and it won't be the last. Remote-access infrastructure is a prime target precisely because it's the door businesses leave open on purpose, for legitimate staff, which makes any flaw in it extremely valuable to attackers. Firewalls and VPN appliances often sit quietly in a server room for years, patched only when someone remembers — and that is exactly the gap attackers count on.
At Flitz.ai, powered by The Mejlerö Company GmbH, we keep an eye on exactly this kind of threat so our clients in Obwalden, Nidwalden, Lucerne and Zurich don't have to track every advisory themselves. Our IT support covers network and WLAN setup, Microsoft 365 administration, and security basics like two-factor authentication — the kind of ongoing oversight that catches issues like this before they turn into incidents. If you're not sure whether your firewall is affected or simply want someone to check your network setup, a free network analysis is a good place to start.
We'll keep watching this space. IT vulnerabilities and AI-driven attacks are now part of daily business risk, not a once-a-year concern — and we'll keep reporting on what matters most, as soon as it matters.
Switzerland.