On 6 November 2026, SonicWall published security advisory SNWLID-2026-0014 for its SonicOS firewalls, and on the same day the US Cybersecurity and Infrastructure Security Agency (CISA) added one of its seven flaws, CVE-2026-19868, to its catalogue of vulnerabilities known to be exploited. The flaw lets someone who holds a valid password for another login method get past the SAML sign-in on the SSL-VPN, and with it past the multi-factor authentication (MFA) that SAML enforces.
SonicWall firewalls are a common sight in small and mid-sized manufacturing companies, and their SSL-VPN is often the way engineers reach the office from home, from a customer site or from a second plant. Behind that VPN usually sit the things a SOLIDWORKS team cares about most: the PDM vault, the file shares with parts, assemblies and drawings, the SolidNetWork License Manager and the backups of all of them.
SonicWall has fixed the problem in new SonicOS builds and says there is no workaround. CISA has told US federal agencies to act by 20 November 2026. Here is what is known, what is not, and what SOLIDWORKS teams should check this week.
TL;DR: if your SonicWall SSL-VPN uses SAML sign-in, update SonicOS now and check who logged in without it
CVE-2026-19868 (CVSS 7.1) affects Gen7 firewalls on SonicOS 7.3.3-7015 or older and Gen8 firewalls on 8.2.2-8015 or older, but only when the SSL-VPN uses SAML login. An attacker with valid credentials for an alternate login method can bypass the SAML controls and possibly the MFA behind them. SonicWall says it investigated a report of potential exploitation, and CISA lists the flaw as exploited. The fixes are SonicOS 7.3.4-7013 and 8.2.3-8015. For SOLIDWORKS teams, the lesson goes beyond one patch: a VPN login with a stolen password looks like a normal engineer working from home, so limit what VPN users can reach and protect the CAD files themselves.
What did SonicWall disclose on 6 November?
SonicWall's advisory, SNWLID-2026-0014, covers seven vulnerabilities in SonicOS, the operating system of its firewalls. One of them, CVE-2026-19868, has been reported as exploited. SonicWall describes it as "an authentication enforcement vulnerability in SonicOS SSLVPN service" that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls, and adds that successful exploitation may also bypass SAML-enforced MFA.
SonicWall rates the flaw 7.1 out of 10 and classifies it as use of single-factor authentication. It was reported by Ryan Harris of The Electronic Office. According to SonicWall, its product security team "has investigated a report indicating potential exploitation of this vulnerability". Neither SonicWall nor CISA has published details of the attacks, and it is not known whether the flaw was used before the fix existed, as SecurityWeek reported.
The other six flaws in the same advisory are not reported as exploited, but they are fixed by the same update:
- Two management interface flaws, each rated 8.8, which under certain circumstances could be exploited by a remote attacker without logging in.
- Three pre-authentication buffer overflows in the SSL-VPN service and the TACACS+ authentication client, which could be used to crash services.
- A weak password hashing issue in virtual appliances, which could give an attacker who already has high privileges a platform credential.
Which SonicWall firewalls are affected?
The exploited flaw affects Gen7 TZ, NSa, NSsp and NSv firewalls running SonicOS 7.3.3-7015 or older, and Gen8 TZ, NSa and NSv firewalls running SonicOS 8.2.2-8015 or older. SonicWall stresses that the SSL-VPN is only affected if SAML is enabled for SSL-VPN logins. SAML is the standard that lets the firewall hand the sign-in over to an identity provider such as Microsoft Entra ID or Okta, which then asks for MFA.
The fixed versions are SonicOS 7.3.4-7013 for Gen7 and 8.2.3-8015 for Gen8. SonicWall says no workaround is available and that customers "are strongly urged to upgrade to the latest release as soon as possible to mitigate the associated risks".
CISA added CVE-2026-19868 to its Known Exploited Vulnerabilities catalogue on 6 November and set 20 November 2026 as the deadline for US federal civilian agencies. Its entry lists use in ransomware campaigns as unknown. CISA deadlines bind only federal agencies, but they are a useful signal for everyone else: a flaw on that list is being used in real attacks.
How does the bypass work, and why does it matter for CAD data?
Many companies switch their VPN to SAML precisely so that every remote login goes through their identity provider and its MFA. The flaw breaks that promise in one specific situation: when an account can also sign in with another method, the firewall may accept that login without insisting on SAML. The attacker still needs a valid password for that other method, but no longer needs the second factor.
SonicWall has not said which alternate methods are involved, and no technical write-up of the attack has been published. Practically, it means any account that has both a SAML sign-in and some other password on the firewall deserves attention, especially old local accounts and accounts synchronised from a directory.
Passwords are not hard to come by. They leak from other services, are stolen by info-stealing malware on home computers and are guessed when people reuse them. Once a remote login succeeds, the attacker looks like an engineer working from home. That is why a VPN flaw quickly becomes a design data problem: the same tunnel that lets your team open assemblies from home lets an intruder copy them.
We saw the same pattern last week with the Ivanti VPN zero-days and the remote access path to PDM vaults, and earlier with phone-call and device code attacks on SharePoint that targeted manufacturers. In each case the attacker did not need to break SOLIDWORKS. They only needed to log in.
Has this happened to SonicWall users before?
Yes, and the history is the strongest reason to act quickly. From July 2025, Arctic Wolf reported a wave of Akira ransomware intrusions that started with SonicWall SSL-VPN logins. SonicWall linked the activity to CVE-2024-40766, an access control flaw fixed in August 2024, and to companies that had moved from Gen6 to Gen7 firewalls without resetting local user passwords. Arctic Wolf saw malicious logins even on accounts with one-time-password MFA enabled, and reported that attackers could go from VPN login to ransomware in four hours or less.
In September and October 2025, SonicWall also disclosed that attackers had accessed firewall configuration backups stored in its MySonicWall cloud backup service. After an investigation with Mandiant, SonicWall said the files of all customers who used that service had been accessed, and asked them to reset credentials. Configuration files describe users, groups and network settings, which is exactly what an attacker needs to plan a VPN login.
None of this proves that CVE-2026-19868 is being used by the same people. It does show that SonicWall VPN access is a proven route into companies, that stolen credentials keep working long after a patch, and that ransomware groups now list CAD drawings as loot.
What does a SOLIDWORKS team expose through its VPN?
Before you decide how urgent this is for you, list what a remote user can actually reach once the tunnel is up. In many small engineering firms the answer is "everything", because the VPN was set up years ago for convenience. Typical items look like this:
If you keep CAD files or PDM backups on network storage, our guide to the ransomware wave against unpatched Synology NAS devices covers the same ground from the storage side. For the vault itself, start with our SOLIDWORKS PDM security configuration guide and the common PDM security mistakes we see in real installations.
A stolen VPN password should not mean stolen designs.
BORIS for SOLIDWORKS registers your CAD files with a blockchain timestamp and a certificate of ownership from inside SOLIDWORKS. If designs leave your network, you can still show what your team created and when.
👉 Get BORIS for SOLIDWORKS
What should SOLIDWORKS teams do now?
- Find every SonicWall firewall. Note the model, generation, SonicOS build and whether SSL-VPN with SAML login is switched on. Include branch offices, second plants and any firewall your IT partner manages for you.
- Update SonicOS. Install 7.3.4-7013 on Gen7 or 8.2.3-8015 on Gen8. There is no workaround, so if you cannot update quickly, consider switching off SSL-VPN until you can.
- Check which SAML users also have another login. Look for local firewall accounts and directory accounts that can sign in to the SSL-VPN without SAML. Remove the ones nobody needs.
- Read the VPN logs. Look for successful logins by SAML users through another method, logins at odd hours, from hosting providers or from countries where you have no staff, and new local accounts.
- Reset exposed credentials. If anything looks wrong, or if your firewall has run old firmware for a long time, reset VPN passwords and one-time-password secrets, plus any service accounts used by PDM or the licence server.
- Lock down the management interface. Two of the other flaws affect it. Do not expose firewall administration to the internet, and limit it to named IT staff.
- Narrow what VPN users can reach. Give engineers access to the vault and the licence server, not to every share and server. Contractors and sales staff need even less. Our guide to protecting SolidWorks files in remote work shows how to split this up.
- Protect the files themselves. Network controls fail sooner or later. Use role-based access inside PDM, keep access logs, and keep dated proof of your key designs so a leak does not also cost you the ability to prove ownership.
Is MFA still worth it if it can be bypassed?
Yes. MFA still stops most attacks that rely on a stolen password, and this flaw does not affect VPNs that do not use SAML. The lesson is narrower: MFA only protects you if every login path enforces it. Old local accounts, test users, shared service accounts and fallback logins are where the gaps hide, on SonicWall and on every other remote access product.
Passwords alone are a weak lock for CAD data in any case, as we explained in why traditional password protection fails for CAD files. The same goes for the licence server: our article on SolidWorks licence management and security explains why it deserves the same care as the vault. Teams with several sites can use our setup guide for secure CAD sharing between offices to replace broad VPN access with narrower connections.
Finally, remember who is targeting engineers. Our report on fake job offers aimed at drone and defence engineers shows how attackers collect exactly the credentials that make a VPN login possible, and our overview of CAD security for manufacturing companies puts the VPN in the wider picture.
How does this fit the bigger picture for CAD users?
Across our network this week, the common thread is control over who can reach your systems and your designs:
- Connected equipment. BORIS Inventor reports on attacks on internet-exposed refrigeration controllers that forced supermarkets in Europe to defrost, and what machine builders should learn about default passwords and remote access in the products they ship.
- Funding and IP. CADChain explains the EIC Work Programme 2027 and its EUR 1.8 billion budget, including the IP strategy and freedom-to-operate material that applicants now need to show.
- Asset licences. Blended BORIS covers Quixel Megascans going free on Fab again, with updated terms that allow AI training on the scans.
Conclusion
CVE-2026-19868 is not the most severe flaw SonicWall has ever fixed, but it is exploited, it has no workaround and it targets exactly the control many companies rely on: MFA on the VPN. If your SonicWall SSL-VPN uses SAML sign-in, update SonicOS now, check which accounts can log in another way and read the logs for logins you cannot explain.
Then use the moment to ask the bigger question. If someone logged in as one of your engineers tomorrow, what could they copy? Narrow VPN access, tighten permissions inside PDM and keep dated proof of your designs, so a single stolen password does not decide who owns your work.
Keep independent proof of your SOLIDWORKS designs, whatever happens to your network.
BORIS for SOLIDWORKS adds blockchain timestamps and certificates of ownership to your CAD files from inside SOLIDWORKS, so you can show what your team designed and when, even after a breach.
👉 Get BORIS for SOLIDWORKS
FAQ: SonicWall CVE-2026-19868 and SOLIDWORKS teams
What is CVE-2026-19868?
An authentication flaw in the SSL-VPN service of SonicWall SonicOS. A user with valid credentials for an alternate login method may bypass SAML authentication controls, and possibly the MFA that SAML enforces. SonicWall rates it 7.1 and disclosed it on 6 November 2026 in advisory SNWLID-2026-0014.
Is it being exploited?
SonicWall says it investigated a report of potential exploitation, and CISA added the flaw to its Known Exploited Vulnerabilities catalogue on 6 November 2026. No details of the attacks, victims or attackers have been published.
Which versions fix it?
SonicOS 7.3.4-7013 for Gen7 firewalls and 8.2.3-8015 for Gen8 firewalls. Gen7 builds 7.3.3-7015 and older and Gen8 builds 8.2.2-8015 and older are affected. SonicWall says there is no workaround.
We use SonicWall but not SAML for the VPN. Are we affected?
Not by CVE-2026-19868, which only affects SSL-VPN with SAML login enabled. You should still install the update, because it fixes six other flaws, including two in the management interface rated 8.8.
Does this affect SOLIDWORKS itself?
No. The flaw is in the SonicWall firewall, not in SOLIDWORKS, PDM or the licence manager. It matters because the SSL-VPN is often the gateway to those systems and to your CAD files.
What is the deadline?
CISA requires US federal civilian agencies to act by 20 November 2026. Private companies are not bound by that date, but since the flaw is exploited and has no workaround, updating this week is sensible.
How does BORIS for SOLIDWORKS help?
It does not patch firewalls or block intruders. It gives your SOLIDWORKS files blockchain-timestamped certificates of ownership, so if designs are copied after a breach you can still prove what your team created and when.