Manufacturing is the most targeted industry for ransomware. Dragos counted 747 ransomware incidents against manufacturers in the second quarter of 2026, about 65 percent of all the industrial incidents it tracked. The way in is rarely the factory floor. It is usually the IT front door: VPNs, firewalls, and remote access tools.

Manufacturers Are Ransomware’s Top Target, and a Newly Exploited SonicWall VPN Flaw Can Bypass MFA

This week, that front door got a new warning.

What Happened

SonicWall disclosed a flaw, tracked as CVE-2026-19868, in the SSL VPN on its Gen7 and Gen8 firewalls. When the VPN uses SAML sign-in, which is often where multi-factor authentication is enforced, someone holding valid credentials for a different login method can skip the SAML step, and the MFA with it.

CISA added the flaw to its Known Exploited Vulnerabilities list on November 6, which means attackers are using it. SonicWall fixed it, along with six other flaws, in SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8). There is no workaround. Updating is the only fix.

Why This Matters for Manufacturers

Engineers, plant managers, and vendors use the VPN to reach your ERP, file servers, and production systems. Dragos found that ransomware stops plants through those IT systems, including ERP, virtualization, identity, and remote access gateways, not through the control systems themselves.

One Akira intrusion Dragos described began with an old VPN account that had no MFA. The attackers then spent days quietly stealing credentials and destroying backups before they encrypted anything. When West Pharmaceutical Services was hit in May, it shut down systems globally, and its core systems took about ten days to restore.

What Your Team Should Do Right Now

  • Ask your IT team whether you run a SonicWall firewall. If so, confirm it is on 7.3.4-7013 or later (Gen7) or 8.2.3-8015 or later (Gen8).
  • Remove VPN accounts you no longer need, especially those for former employees and past contractors.
  • Have IT review recent VPN sign-ins for accounts that should only use your single sign-on login.
  • This flaw needs valid credentials, so find out whether yours are already exposed. INFORTECH’s Dark Web Scan checks for that, and a password manager like Keeper keeps every login unique.
  • Give every firewall, VPN, and remote access tool the same fast patching.

The Bottom Line

For a manufacturer, the VPN is the front door to the systems that keep production running. When a flaw lets attackers walk past MFA, patching it is part of keeping the plant running.