On 6 November 2026, the US cyber agency CISA added a SonicWall weakness, CVE-2026-19868, to its Known Exploited Vulnerabilities (KEV) catalogue. That list only holds weaknesses that are confirmed to be used in real attacks.
The flaw is in the remote access (SSLVPN) feature of SonicOS, the software that runs SonicWall firewalls. Many small businesses use these firewalls to let staff connect to the office network from home. The flaw can let someone get past the second sign-in check.
What is confirmed, and what is claimed
Confirmed:
- CISA lists CVE-2026-19868 as a SonicWall SonicOS SSLVPN weakness. Its description says a user with valid credentials for an alternate sign-in method can bypass SAML authentication controls, and that this may also bypass MFA (multi-factor authentication: a second check after the password) that SAML enforces. SAML is a way of signing in through a central identity service. CISA added it on 6 November 2026 with a due date of 20 November 2026 for US federal agencies. (CISA KEV catalogue)
- The Canadian Centre for Cyber Security reports that SonicWall says the flaw is being exploited. It lists the affected SonicOS versions as those before 7.3.4-7013 and those before 8.2.2-8015. (Canadian Centre for Cyber Security: SonicWall security advisory AV26-1133)
Not confirmed: CISA lists known ransomware use as "Unknown". We did not find public detail on who is exploiting the flaw, how many devices are affected, or whether any South African business has been hit, so this post does not guess. The SonicWall advisory page itself could not be opened when this post was written, so check it for the exact fixed versions and any workarounds.
Why it matters to a business like yours
A firewall's remote access service sits on the edge of your network and is reachable from the internet. If the second check can be skipped, a stolen or guessed password may be all an attacker needs, and from there they are inside the network as if they were a member of staff.
The weakness needs the attacker to hold valid credentials for some other sign-in method, so it is not a way in for a complete stranger. But passwords are leaked, reused and sprayed at businesses every day, which is why the second check exists. We wrote about this in password spraying on Microsoft 365.
For a South African business, an intruder on the network can reach files and systems that hold customers' personal information. That can turn into a security compromise you have to deal with under POPIA (the Protection of Personal Information Act).
What to do now
Ask your IT people these questions, and ask for answers in writing:
- Do we use a SonicWall firewall with remote access (SSLVPN)? If yes, which SonicOS version is it running?
- Is it on 7.3.4-7013 or 8.2.2-8015 or later? Those are the limits in the Canadian advisory. Confirm against SonicWall's own advisory (SNWLID-2026-0014) and apply the update or the vendor's mitigation.
- Do we sign in to remote access through SAML? If so, make sure the alternate sign-in methods that are no longer needed are switched off.
- Has anyone looked at recent remote access logins? Look for sign-ins at odd hours or from countries you do not work in.
- Are passwords for remote access users long and unique? Change any that may have been reused.
How you would know
Vikelus is part of how F1 IT Solutions looks after its clients, and it helps in two ways here.
On the Microsoft 365 side, it checks sign-ins every 10 minutes. A successful sign-in from a country a business does not normally work from is flagged, and F1's team is alerted by email, usually within minutes. Each attempt is kept with its country, approximate city and network owner, so a technician can see where in the world it came from. This watches your Microsoft 365 accounts, not the firewall itself.
On the website and email side, it checks your domains daily from the outside using only public information, including exposed services. It does not read the inside of a firewall, and it does not change any settings. F1's technicians do the fixing, and Vikelus checks that the fix worked.
You can see how this fits together on the how it works page. If you would like to see what Vikelus would watch for your business, book a walkthrough.
