decrypted · 8 november 2026 · vulnerabilities and patching · ai and llm security

SonicWall's single sign-on check can be skipped, and attackers are already doing it

SonicWall has patched a flaw in the remote access feature of its firewalls that lets someone holding one kind of valid login walk past the single sign-on check, and CISA, America's national cyber security agency, has confirmed attackers are already using it. The alert landed on Friday, after this morning's post, but it matters to any UK organisation whose staff dial in through a SonicWall. The uncomfortable part is the second factor, the control many boards were told made remote access safe.

What actually broke

The flaw is tracked as CVE-2026-19868 and scored 7.1 out of ten. Picture an office with two entrances. The front desk checks your badge against the company's central system, which here is SAML, the standard behind many single sign-on logins. A side door accepts a password instead. The guard there checks the password, nods, and never consults the front desk. CISA describes a flaw that may let a user with valid credentials for an alternate authentication method bypass SAML controls, and may also bypass MFA, the second check on top of the password, where it is enforced through SAML.

It matters only if the SSL-VPN service uses SAML. SSL is the older name for the encryption behind the browser padlock. According to BleepingComputer, SonicOS Gen7 7.3.3-7015 and earlier and Gen8 8.2.2-8015 and earlier are affected, fixes are 7.3.4-7013 and 8.2.3-8015, and there is no workaround. Sources differ slightly on the Gen8 boundary, so check SonicWall's own advisory.

What the defender sees

SonicWall said it "has investigated a report indicating potential exploitation" and urged customers to upgrade, without detailing the attacks. CISA added the flaw to its KEV list, the catalogue of flaws known to be exploited in real attacks, on 6 November, and marked ransomware use as "Unknown".

The attacker needs a real username and password, so the log entry looks like a legitimate login. My suggestion, which is opinion and not vendor guidance, is to look for VPN sessions with no matching event at your identity provider, the system that normally issues the second prompt. If the front desk never saw the visitor, someone used the side door.

The design lesson

Secure by Design asks how many ways into a system there are, and whether every one passes through the same check. Here, one route did not honour the policy set for the others. Authentication decided in one place cannot be skipped by choosing a different route.

The cost is modest. List every authentication method enabled on each gateway, switch off the ones nobody uses, then test, rather than assume, that each remaining method still triggers the second factor. For buyers, ask the vendor whether policy is enforced at one point, and get the answer in writing.

Also this week

A password manager's cloud was breached. mSeven Software told current and former mSecure customers on 3 November to change passwords, reset two-factor authentication and remove passkeys, BleepingComputer reported. Customer-shared support replies, not an official statement, say an encrypted database was taken from mSecure Cloud and that only users syncing with it are affected. The company has not said how many users, or how the attacker got in, and says it has no evidence the vault contents were accessed. Treat that as the company's account, not a finding. BleepingComputer compared the risk to the 2022 LastPass breach, which researchers later linked to cryptocurrency thefts. The old design point stands: a properly encrypted vault still invites offline guessing, so a long master password matters more than a clever one. Change the master password if you sync, and reset any second factor tied to it.

An AI agent swarm found a login bug that has lurked since 2016. Researcher Ozgun Kultekin says he used agents to run about 17,600 logins against differently built OpenSSH servers and noticed the one build that disagreed. On Linux systems using the musl library, such as Alpine, an oversized password can log in to accounts with password logins blocked, under specific conditions. Per the researcher, Alpine's official AWS and Azure images ship a default account with passwordless doas privileges, which could turn a login into root. OpenSSH 10.6p2 fixes it, and switching off SSH password logins avoids it. The irony is that a 2016 patch meant to stop username guessing created the flaw. For UK organisations running Alpine, checking the version is a ten minute job, and defenders can run the same automated testing against their own builds before attackers do.

Sources