SonicWall firewall VPN logins can skip multi-factor checks.

What's happening.

SonicWall TZ, NSa, NSsp and NSv firewalls are common in small offices, and their SSL VPN lets staff connect from home. Some businesses make VPN users sign in through SAML, for example with Microsoft or Google accounts, so that a multi-factor check is always applied.

This flaw lets someone who has a valid login for another sign-in method on the firewall get past the SAML step. That can also skip the multi-factor check. It only affects firewalls where SAML is turned on for SSL VPN logins.

SonicWall published the fix on 6 November 2026, together with six other SonicOS flaws. CISA added this one to its list of exploited vulnerabilities the same day.

What it means for you.

Multi-factor checks are there to stop a stolen password being enough. If they can be skipped, an attacker with one leaked or guessed password can connect to your office network as if they were a member of staff, and reach file shares, email and backups from there.

How to fix it.

1. Update SonicOS to 7.3.4-7013 or later on Gen7 firewalls, or 8.2.3-8015 or later on Gen8 firewalls. SonicWall says there is no workaround, so the update is the fix.
2. Ask your IT provider whether you have a SonicWall firewall, which generation it is, and whether SAML is used for VPN logins.
3. Look at recent VPN logins for users, times or places you do not recognise, and remove VPN access from accounts that do not need it.
4. Change passwords for any local or directory accounts that can also sign in to the VPN, especially if they may have been reused elsewhere or leaked.
5. Make sure the firewall's management pages are not open to the whole internet. The same update fixes two management interface flaws rated 8.8.