The firewall sits on a shelf in a closet behind the front desk, next to a box of toner and a nest of cables nobody wants to touch. It has been on for years. It is the only thing standing between the internet and everything the business keeps: the file server, the scheduling software, the folder where payroll lives.
On Friday, SonicWall published an advisory for seven problems in the software that runs on those boxes. One of them is already being used against real companies. CISA added it to its list of vulnerabilities known to be exploited in the wild the same day it went public, November 6.
What the flaw actually does
The short version. The VPN was supposed to check two things before it let somebody in. A password. Then a second step, usually a code or an approval on a phone.
This flaw lets a person who already has a working username and password walk past the second step.
SonicWall is specific about the conditions, and the specifics matter. The problem only exists if the firewall is set up to check VPN logins through single sign-on, the arrangement where staff sign in with their Microsoft or Google account instead of a separate firewall password. In that setup, someone who holds valid credentials for a different login method can get through the VPN without passing the check that single sign-on was enforcing.
So this is not a stranger guessing passwords at the login screen. It is somebody who already has one that works. A password from a phished email. A password someone reused on three sites. A password on an account that belonged to an employee who left in 2023 and was never turned off.
That last one is the common case. Accounts outlive people.
The fix, and why it cannot wait
The fix is a firmware update. SonicOS 7.3.4-7013 or later on Gen7 hardware, 8.2.3-8015 or later on Gen8. The affected versions are 7.3.3-7015 and older, and 8.2.2-8015 and older. The list of models includes the TZ 270 through TZ 680, the NSa line, the NSsp line, and the virtual NSv appliances.
SonicWall lists no workaround. There is no setting to change, no rule to add, no clever mitigation. The update is the fix.
CISA gave federal agencies until November 20 to patch it. You are not a federal agency, and that deadline is not yours. It is still a reasonable speed to move at, because of what happens after the door opens.
Why the edge of the network is the whole game
In August, the FBI, CISA and the Department of Health and Human Services updated their joint advisory on Medusa, a ransomware operation that has been running since 2021. As of April 2026, Medusa's developers and their affiliates had hit more than 500 victims. The industries listed: medical, education, legal, insurance, technology, manufacturing.
The advisory says they are not choosy. They go after organizations running unpatched software rather than picking targets by size or sector. They read vulnerability announcements the way other people read the news, and the FBI has observed them using new exploits within a day of publication.
Read that list of industries again and think about a small town in the Upper Peninsula. The clinic. The dental office. The law firm that does closings. The insurance agency. The machine shop with two shifts and one person who understands the network.
None of those places think of themselves as a target. That is the point. The scanning does not care.
The advisory also notes that Medusa buys access from brokers rather than always breaking in itself. That tells you something useful about the economics. Access to a company is a product with buyers. The size of the company is not the qualification. A door somebody forgot to close is.
What to do this week
Find the box. Get the model and the firmware version off the management page. If you do not know where the management page is, that is the first problem to solve.
Ask whether the VPN is turned on, and whether single sign-on is enabled for it. If nobody can answer that in ten minutes, you have learned something more valuable than the answer.
Update the firmware, then confirm the version actually changed. A scheduled update that quietly fails looks exactly like success from the outside.
Turn the VPN off for anyone who does not use it. Remote access that exists for one person who works from home twice a month should not be open to every account in the directory.
Close management access from the open internet. The admin page on a firewall has no business being reachable from a hotel in another country.
Read the VPN login log. Look for sessions at strange hours, from places your staff are not, and from accounts that should be closed.
The honest part
A patched firewall does not make a business secure. It makes the business not the easy one on the list, which is a different and more achievable thing.
The crews are not choosing you. They are choosing whatever answers the door. That is the reason a patch note from a firewall vendor on a Friday afternoon is worth an hour of somebody's attention: not because this one flaw is the end of the world, but because the next one is a few weeks out, and the only real question is whether anyone is watching the closet.
Call us at (906) 662-4481, or contact us for a free assessment.