CISA KEV Addition: SonicWall SonicOS SSLVPN Single-Factor Authentication / SAML Bypass Vulnerability (CVE-2026-19868)

Key facts for SonicWall SSLVPN SAML bypass

Detection coverage for SonicWall SSLVPN SAML bypass

As of 2026-11-07, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-5447 across Splunk SPL, Microsoft KQL and Sigma, covering 17 indicator(s) of compromise. The whole corpus is readable without an account. Every threat comes with one complete detection in Splunk SPL, Microsoft KQL and Sigma, free for everyone; a free account adds daily TL Creds to unlock the rest. Paid plans add a larger daily allowance, correlation and the MCP server. Threadlinqs MCP server · View plans.

Free detection: CVE-2026-19868 SonicOS SSLVPN Login Without SAML IdP Assertion — Exploitation (SPL)

Correlates successful SonicOS SSLVPN logins (SNWLID-2026-0014) with SAML/IdP sign-in events for the same user within 10 minutes. A VPN session with no matching SAML assertion indicates an alternate authentication method was used to bypass SAML/MFA enforcement (CWE-308), the core exploitation behaviour of CVE-2026-19868.

• Languages: Splunk SPL, Microsoft KQL, Sigma
• ATT&CK: T1190, T1133, T1078, T1556.006, T1556
• Data sources: sonicwall:syslog (index=network, sourcetype=dell:sonicwall), okta:im2:log (index=idp), azure:aad:signin (index=idp)
• Severity: critical
• Confidence: high

Splunk SPL

(index=network sourcetype="dell:sonicwall" "SSLVPN" ("login successful" OR "login allowed") NOT "SAML")
OR (index=idp ((sourcetype="okta:im2:log" eventType="user.authentication.sso" outcome.result=SUCCESS "SonicWall") OR (sourcetype="azure:aad:signin" appDisplayName="*SonicWall*" status.errorCode=0)))
| eval user=lower(coalesce(usr, 'actor.alternateId', userPrincipalName))
| eval user=replace(user, "@.*$", "")
| eval leg=if(sourcetype="dell:sonicwall", "vpn", "saml")
| bin _time span=10m
| stats count(eval(leg="vpn")) AS vpn_logins count(eval(leg="saml")) AS saml_assertions values(src) AS vpn_src values(host) AS firewall BY user _time
| where vpn_logins>0 AND saml_assertions=0
| table _time user vpn_src firewall vpn_logins saml_assertions

Microsoft KQL

let lookback = 24h;
let samlAuth = SigninLogs
    | where TimeGenerated > ago(lookback)
    | where AppDisplayName has "SonicWall" and ResultType == "0"
    | extend UserKey = tolower(tostring(split(UserPrincipalName, "@")[0]))
    | project SamlTime = TimeGenerated, UserKey;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "SonicWall"
| where Message has "SSLVPN" or Activity has "SSLVPN"
| where Message has_any ("login successful", "login allowed") or Activity has_any ("login successful", "login allowed")
| where Message !has "SAML"
| extend UserKey = tolower(tostring(split(SourceUserName, "@")[0]))
| join kind=leftouter samlAuth on UserKey
| extend SamlInWindow = iff(isnotempty(SamlTime) and abs(datetime_diff("minute", TimeGenerated, SamlTime)) <= 10, 1, 0)
| summarize SamlMatches = sum(SamlInWindow) by TimeGenerated, DeviceName, UserKey, SourceIP
| where SamlMatches == 0
| project TimeGenerated, DeviceName, UserKey, SourceIP, SamlMatches

Sigma

title: SonicOS SSLVPN Login Without SAML Authentication (CVE-2026-19868)
id: 6f1d7c52-3b8e-4a49-9c2d-5e0a8b7f1c31
status: experimental
description: Detects successful SonicOS SSLVPN logins whose log message does not reference SAML. Under CVE-2026-19868 (SNWLID-2026-0014, CWE-308) a user holding valid credentials for an alternate authentication method can bypass SAML/MFA enforcement, so SAML-governed accounts may appear in single-factor SSLVPN sessions.
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://nvd.nist.gov/vuln/detail/cve-2026-19868
  - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
  - attack.t1078
  - attack.defense_evasion
  - attack.t1556.006
  - cve.2026.19868
logsource:
  product: sonicwall
  service: sslvpn
detection:
  selection_vpn:
    msg|contains: 'SSLVPN'
  selection_success:
    msg|contains:
      - 'login successful'
      - 'login allowed'
  filter_saml:
    msg|contains: 'SAML'
  condition: selection_vpn and selection_success and not filter_saml
falsepositives:
  - Service, break-glass or local accounts that are intentionally exempt from SAML
  - Firmware builds whose success message omits the authentication method
level: medium

Known false positives:

• Service, break-glass or local accounts intentionally exempt from SAML
• IdP log ingestion delay greater than 10 minutes causing a missing assertion
• Firmware builds that do not log the authentication method

Tuning notes: Restrict to accounts that must authenticate via SAML (group or lookup). Widen the correlation window to match IdP ingestion latency, exclude documented break-glass and service accounts, and adjust the SonicWall success message strings and the IdP app name to your environment. Replace the index names (network, idp) with your own.

• 🔒 CVE-2026-19868 SonicOS SSLVPN Login Without Entra SAML Sign-in — Exploitation (KQL) · unlock with TL Creds
• 🔒 CVE-2026-19868 SonicOS SSLVPN Account Used From Multiple Sources — Post-Exploitation (KQL) · unlock with TL Creds
• 🔒 CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (KQL) · unlock with TL Creds
• 🔒 CVE-2026-19868 SonicOS SSLVPN Login Lacking SAML — Exploitation (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-19868 SonicOS SSLVPN Multi-Source Account Use — Post-Exploitation (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (Sigma) · unlock with TL Creds
• 🔒 CVE-2026-19868 SonicOS SSLVPN Account Used From Multiple Sources — Post-Exploitation (SPL) · unlock with TL Creds
• 🔒 CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (SPL) · unlock with TL Creds

Indicators of compromise for SonicWall SSLVPN SAML bypass

As of 2026-11-07, Threadlinqs Intelligence tracks 17 indicators of compromise for TL-2026-5447.

How SonicWall SSLVPN SAML bypass works

CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSLVPN service, published by SonicWall PSIRT (advisory SNWLID-2026-0014) and in the CVE/NVD record on 2026-11-06. Per the CVE description, a user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls, which can weaken the intended security posture of SonicOS SSLVPN by permitting single-factor authentication where multi-factor authentication is expected. The weakness is classified as CWE-308 (Use of Single-factor Authentication).

Affected versions per the CVE record are SonicOS Gen7 7.3.3-7015 and older, and SonicOS Gen8 8.2.2-8015 and older. At the time of this research the NVD record is 'Undergoing Analysis' with no NVD-assigned CVSS score. Third-party aggregators (OffSeq, Strix) list a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N); that value is not confirmed by NVD and is carried here as a secondary-source figure. The platform assigns CRITICAL priority because CISA lists the CVE in the KEV catalog. No fixed version was identifiable from the sources retrieved; the SonicWall PSIRT page could not be rendered by the fetch tool, so defenders must consult SNWLID-2026-0014 directly for patch and mitigation guidance.

CISA added the CVE to KEV on 2026-11-06 with a federal remediation due date of 2026-11-20 under BOD 26-04 (due date as reported by a third-party aggregator; the CISA alert text itself did not state it). CISA notes this vulnerability type is a frequent attack vector for malicious cyber actors and poses significant risk to the federal enterprise. Some aggregator pages are inconsistent about exploitation status (several auto-generated pages state no exploitation), but the CISA KEV listing is the authoritative signal. No threat actor, campaign, malware, or network indicators are attributed in any retrieved source. No public PoC was identified. Because exploitation requires valid credentials for an alternate authentication method, defenders should hunt for SSLVPN sessions established without the expected SAML/MFA step, especially for accounts that should authenticate only via SAML.

MITRE ATT&CK techniques by tactic:

Initial Access

T1078 Valid Accounts; T1133 External Remote Services; T1190 Exploit Public-Facing Application

Defense Evasion

T1078 Valid Accounts

Persistence

T1133 External Remote Services

Impact

T1499.004 Endpoint Denial of Service

Credential Access

T1556 Modify Authentication Process

defense-impairment

T1556.006 Multi-Factor Authentication

Remediation for SonicWall SSLVPN SAML bypass

Patches

• No fixed version identified in retrieved sources; consult SNWLID-2026-0014

Immediate actions

• Review SonicWall PSIRT advisory SNWLID-2026-0014 and apply any vendor-provided fix or mitigation for SonicOS Gen7 and Gen8
• Inventory SonicOS SSLVPN deployments on Gen7 (7.3.3-7015 and older) and Gen8 (8.2.2-8015 and older)
• Review SSLVPN authentication configuration so accounts cannot authenticate through an alternate method that skips SAML/MFA
• Audit recent SSLVPN logins for sessions that did not complete SAML authentication

Workarounds

• Apply compensating controls per vendor guidance until a patch is available
• Disable or remove alternate (non-SAML) authentication methods for SSLVPN users where operationally possible

Longer-term hardening

• Enforce a single, MFA-backed authentication path for all SSLVPN users
• Reduce exposure of the SSLVPN interface to the internet and restrict to known sources where feasible
• Forward SonicOS authentication and VPN logs to a SIEM and alert on authentication-method anomalies

Affected and fixed versions

• SonicWall — SonicOS SSLVPN (Gen7)
  Vulnerable versions: 7.3.3-7015 and older
• SonicWall — SonicOS SSLVPN (Gen8)
  Vulnerable versions: 8.2.2-8015 and older

Timeline of SonicWall SSLVPN SAML bypass

Last updated 2026-11-07 · 2 updates · revalidated 2× · latest source

• 2026-08-14 VulDB reports the vulnerability as identified under CVE-2026-19868 from this date (secondary-source claim, not confirmed by vendor or locked-ioc-17)
• 2026-11-06 BleepingComputer reports the SSL-VPN MFA bypass and credits discovery to locked-ioc-15 of locked-ioc-14
• 2026-11-06 locked-ioc-16 releases fixed builds locked-ioc-12 and Gen8 8.2.3-8015, alongside fixes for six other SonicOS flaws (not confirmed exploited)
• 2026-11-06 locked-ioc-16 warns the flaw is being exploited in attacks; locked-ioc-16 states no workarounds exist and an upgrade is required
• 2026-11-06 NVD record last modified (20:38 UTC); no CVSS assigned by NVD at time of research
• 2026-11-06 locked-ioc-17 adds CVE-2026-19868 to the Known Exploited Vulnerabilities Catalog based on evidence of active exploitation
• 2026-11-06 CVE-2026-19868 published in the CVE/NVD record (19:17 UTC) with CWE-308 and affected versions Gen7 7.3.3-7015 and older, Gen8 8.2.2-8015 and older; NVD status Undergoing Analysis
• 2026-11-06 locked-ioc-16 PSIRT publishes advisory SNWLID-2026-0014 for the SonicOS SSLVPN authentication enforcement vulnerability
• 2026-11-07 GBHackers reports the SSL-VPN MFA bypass; its headline claims active attacks while the body describes only potential exploitation and no confirmed widespread campaign
• 2026-11-07 NVD updates the CVE-2026-19868 record (secondary-source CVSS 7.5 with PR:N) and the CVE-2026-107155 record
• 2026-11-20 Reported federal remediation deadline for KEV entry under BOD 26-04 (date per third-party aggregator)

Update history

• 2026-11-07 — locked-ioc-16 SonicOS SSL-VPN Authentication Enforcement Flaw (CVE-2026-19868) Enables SAML/MFA Bypass; Added to locked-ioc-17 KEV: What changed No field changes. The newer report scores CVSS 7.1 (advisory, PR:L) and HIGH severity versus the existing 7.5 and CRITICAL. These are lower values, so they were not applied under the escalation-only rule. CRITICAL also rests on
• 2026-11-07 — locked-ioc-16 SonicOS SSL-VPN SAML/MFA Bypass (CVE-2026-19868) Exploited in the Wild: What changed No whitelisted field escalation (severity CRITICAL, exploitability ACTIVE, status ACTIVE, CVSS 7.5 already recorded). Patch status changes from 'no fixed version identified' to fixes available: Gen7 7.3.4-7013, Gen8 8.2.3-8015.

Sources cited for SonicWall SSLVPN SAML bypass

• CISA Adds One Known Exploited Vulnerability to Catalog CISA · Government advisory · 2026-11-06
• CVE-2026-19868 Record CVE Program · Advisory · 2026-11-06
• NVD - CVE-2026-19868 NVD (NIST) · Advisory · 2026-11-06
• CISA Known Exploited Vulnerabilities Catalog CISA · Government advisory · 2026-11-06
• SonicWall PSIRT SNWLID-2026-0014 psirt.global.sonicwall.com · Vendor report · 2026-11-06
• OffSeq Radar - CVE-2026-19868 SonicOS Use of Single-factor Authentication radar.offseq.com · Research · 2026-11-06
• Strix - CVE-2026-19868 SonicOS Vulnerability strix.ai · Research · 2026-11-06
• VulDB - CVE-2026-19868 SonicWall SonicOS SSLVPN Service improper authentication vuldb.com · Research · 2026-11-06

More in vulnerability

• Local Privilege Escalation in Siemens TeleControl Server Basic before V3.1.2.4 (CVE-2025-40942)
• Privilege Escalation in WIBU CodeMeter Runtime Affecting Siemens Desigo CC Product Family and SENTRON Powermanager (CVE-2025-47809)
• Siemens SSA-282044: DLL Hijacking in Siemens Web Installer (SIWA) used by Online Software Delivery (CVE-2025-30033)
• Siemens SSA-364175: Multiple Vulnerabilities in Palo Alto Networks Virtual NGFW on RUGGEDCOM APE1808 (CVE-2024-3596, CVE-2025-4231 and others)
• SSA-365200: Google Chrome V8 Type Confusion Vulnerability (CVE-2025-6554) in Siemens HyperLynx and Industrial Edge App Publisher

Previous and next in vulnerability

• Firefox for Windows Layout Out-of-Bounds Vulnerability (CVE-2026-120572) Fixed in 159.0.1 Previous report
• Multiple Vulnerabilities in Google Chrome prior to 157.0.8103.38 (CVE-2026-121029 through CVE-2026-121257) - HK GovCERT Alert A26-11-05 Next report