# CISA KEV Addition: SonicWall SonicOS SSLVPN Single-Factor Authentication / SAML Bypass Vulnerability (CVE-2026-19868)

> CISA added CVE-2026-19868, a CWE-308 'Use of Single-factor Authentication' flaw in the SonicWall SonicOS SSLVPN service, to the Known Exploited Vulnerabilities Catalog on 2026-11-06 based on evidence of active exploitation. A user holding valid credentials for an alternate authentication method can bypass SAML authentication controls, weakening the MFA posture of the VPN.

- **Published:** 2026-11-06T21:12:16Z
- **Last reviewed:** 2026-11-07T05:57:36.246Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-5447
- **ID:** TL-2026-5447
- **Severity:** CRITICAL (CVSS 7.5)
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 (1 shown free below) · **IOCs:** 17
- **CVEs:** CVE-2026-19868, CVE-2026-107155, CVE-2026-107154, CVE-2026-82308, CVE-2026-77708, CVE-2026-77709, CVE-2026-19703

## Description

CVE-2026-19868 is an authentication enforcement vulnerability in the SonicOS SSLVPN service, published by SonicWall PSIRT (advisory SNWLID-2026-0014) and in the CVE/NVD record on 2026-11-06. Per the CVE description, a user with valid credentials for an alternate authentication method may be able to bypass SAML authentication controls, which can weaken the intended security posture of SonicOS SSLVPN by permitting single-factor authentication where multi-factor authentication is expected. The weakness is classified as CWE-308 (Use of Single-factor Authentication).

Affected versions per the CVE record are SonicOS Gen7 7.3.3-7015 and older, and SonicOS Gen8 8.2.2-8015 and older. At the time of this research the NVD record is 'Undergoing Analysis' with no NVD-assigned CVSS score. Third-party aggregators (OffSeq, Strix) list a CVSS 3.1 base score of 7.5 (AV:N/AC:H/PR:N/UI:N/S:C/C:H/I:L/A:N); that value is not confirmed by NVD and is carried here as a secondary-source figure. The platform assigns CRITICAL priority because CISA lists the CVE in the KEV catalog. No fixed version was identifiable from the sources retrieved; the SonicWall PSIRT page could not be rendered by the fetch tool, so defenders must consult SNWLID-2026-0014 directly for patch and mitigation guidance.

CISA added the CVE to KEV on 2026-11-06 with a federal remediation due date of 2026-11-20 under BOD 26-04 (due date as reported by a third-party aggregator; the CISA alert text itself did not state it). CISA notes this vulnerability type is a frequent attack vector for malicious cyber actors and poses significant risk to the federal enterprise. Some aggregator pages are inconsistent about exploitation status (several auto-generated pages state no exploitation), but the CISA KEV listing is the authoritative signal. No threat actor, campaign, malware, or network indicators are attributed in any retrieved source. No public PoC was identified. Because exploitation requires valid credentials for an alternate authentication method, defenders should hunt for SSLVPN sessions established without the expected SAML/MFA step, especially for accounts that should authenticate only via SAML.

## MITRE ATT&CK

- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1078 Valid Accounts
- T1133 External Remote Services
- T1556.006 Multi-Factor Authentication
- T1078 Valid Accounts
- T1556 Modify Authentication Process
- T1499.004 Endpoint Denial of Service

## Free detection (Splunk SPL, Microsoft KQL, Sigma)

**CVE-2026-19868 SonicOS SSLVPN Login Without SAML IdP Assertion — Exploitation (SPL)** (`TL-2026-5447-SPL-001`)

Correlates successful SonicOS SSLVPN logins (SNWLID-2026-0014) with SAML/IdP sign-in events for the same user within 10 minutes. A VPN session with no matching SAML assertion indicates an alternate authentication method was used to bypass SAML/MFA enforcement (CWE-308), the core exploitation behaviour of CVE-2026-19868.

- **Languages:** Splunk SPL, Microsoft KQL, Sigma
- **ATT&CK:** T1190, T1133, T1078, T1556.006, T1556
- **Data sources:** sonicwall:syslog (index=network, sourcetype=dell:sonicwall), okta:im2:log (index=idp), azure:aad:signin (index=idp)
- **Severity:** critical
- **Confidence:** high

### Splunk SPL

```spl
(index=network sourcetype="dell:sonicwall" "SSLVPN" ("login successful" OR "login allowed") NOT "SAML")
OR (index=idp ((sourcetype="okta:im2:log" eventType="user.authentication.sso" outcome.result=SUCCESS "SonicWall") OR (sourcetype="azure:aad:signin" appDisplayName="*SonicWall*" status.errorCode=0)))
| eval user=lower(coalesce(usr, 'actor.alternateId', userPrincipalName))
| eval user=replace(user, "@.*$", "")
| eval leg=if(sourcetype="dell:sonicwall", "vpn", "saml")
| bin _time span=10m
| stats count(eval(leg="vpn")) AS vpn_logins count(eval(leg="saml")) AS saml_assertions values(src) AS vpn_src values(host) AS firewall BY user _time
| where vpn_logins>0 AND saml_assertions=0
| table _time user vpn_src firewall vpn_logins saml_assertions
```

### Microsoft KQL

```kql
let lookback = 24h;
let samlAuth = SigninLogs
    | where TimeGenerated > ago(lookback)
    | where AppDisplayName has "SonicWall" and ResultType == "0"
    | extend UserKey = tolower(tostring(split(UserPrincipalName, "@")[0]))
    | project SamlTime = TimeGenerated, UserKey;
CommonSecurityLog
| where TimeGenerated > ago(lookback)
| where DeviceVendor =~ "SonicWall"
| where Message has "SSLVPN" or Activity has "SSLVPN"
| where Message has_any ("login successful", "login allowed") or Activity has_any ("login successful", "login allowed")
| where Message !has "SAML"
| extend UserKey = tolower(tostring(split(SourceUserName, "@")[0]))
| join kind=leftouter samlAuth on UserKey
| extend SamlInWindow = iff(isnotempty(SamlTime) and abs(datetime_diff("minute", TimeGenerated, SamlTime)) <= 10, 1, 0)
| summarize SamlMatches = sum(SamlInWindow) by TimeGenerated, DeviceName, UserKey, SourceIP
| where SamlMatches == 0
| project TimeGenerated, DeviceName, UserKey, SourceIP, SamlMatches
```

### Sigma

```yaml
title: SonicOS SSLVPN Login Without SAML Authentication (CVE-2026-19868)
id: 6f1d7c52-3b8e-4a49-9c2d-5e0a8b7f1c31
status: experimental
description: Detects successful SonicOS SSLVPN logins whose log message does not reference SAML. Under CVE-2026-19868 (SNWLID-2026-0014, CWE-308) a user holding valid credentials for an alternate authentication method can bypass SAML/MFA enforcement, so SAML-governed accounts may appear in single-factor SSLVPN sessions.
references:
  - https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog
  - https://nvd.nist.gov/vuln/detail/cve-2026-19868
  - https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014
author: AII-Detector — ThreadLinqs Intelligence
date: 2026/11/06
tags:
  - attack.initial_access
  - attack.t1190
  - attack.t1133
  - attack.t1078
  - attack.defense_evasion
  - attack.t1556.006
  - cve.2026.19868
logsource:
  product: sonicwall
  service: sslvpn
detection:
  selection_vpn:
    msg|contains: 'SSLVPN'
  selection_success:
    msg|contains:
      - 'login successful'
      - 'login allowed'
  filter_saml:
    msg|contains: 'SAML'
  condition: selection_vpn and selection_success and not filter_saml
falsepositives:
  - Service, break-glass or local accounts that are intentionally exempt from SAML
  - Firmware builds whose success message omits the authentication method
level: medium

```

**Known false positives:**

- Service, break-glass or local accounts intentionally exempt from SAML
- IdP log ingestion delay greater than 10 minutes causing a missing assertion
- Firmware builds that do not log the authentication method

**Tuning notes:** Restrict to accounts that must authenticate via SAML (group or lookup). Widen the correlation window to match IdP ingestion latency, exclude documented break-glass and service accounts, and adjust the SonicWall success message strings and the IdP app name to your environment. Replace the index names (network, idp) with your own.

### 8 more detection rules (Splunk SPL, Microsoft KQL, Sigma), unlock with TL Creds

- CVE-2026-19868 SonicOS SSLVPN Login Without Entra SAML Sign-in — Exploitation (KQL) (locked: unlock with TL Creds)
- CVE-2026-19868 SonicOS SSLVPN Account Used From Multiple Sources — Post-Exploitation (KQL) (locked: unlock with TL Creds)
- CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (KQL) (locked: unlock with TL Creds)
- CVE-2026-19868 SonicOS SSLVPN Login Lacking SAML — Exploitation (Sigma) (locked: unlock with TL Creds)
- CVE-2026-19868 SonicOS SSLVPN Multi-Source Account Use — Post-Exploitation (Sigma) (locked: unlock with TL Creds)
- CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (Sigma) (locked: unlock with TL Creds)
- CVE-2026-19868 SonicOS SSLVPN Account Used From Multiple Sources — Post-Exploitation (SPL) (locked: unlock with TL Creds)
- CVE-2026-19868 SSLVPN Pool Fan-Out To Admin Ports — Lateral Movement (SPL) (locked: unlock with TL Creds)

Sign up free to unlock the detection rules: https://threadlinqs.com/?modal=signup

## Sources

- [CISA Adds One Known Exploited Vulnerability to Catalog](https://www.cisa.gov/news-events/alerts/2026/11/06/cisa-adds-one-known-exploited-vulnerability-catalog)
- [CVE-2026-19868 Record](https://www.cve.org/CVERecord?id=CVE-2026-19868)
- [NVD - CVE-2026-19868](https://nvd.nist.gov/vuln/detail/cve-2026-19868)
- [SonicWall PSIRT SNWLID-2026-0014](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0014)
- [CISA Known Exploited Vulnerabilities Catalog](https://www.cisa.gov/known-exploited-vulnerabilities-catalog)
- [OffSeq Radar - CVE-2026-19868 SonicOS Use of Single-factor Authentication](https://radar.offseq.com/threat/cve-2026-19868-cwe-308-use-of-single-factor-authentication-in-sonicwall-sonicos-265dbb492eb1f1d3)
- [Strix - CVE-2026-19868 SonicOS Vulnerability](https://www.strix.ai/cve/CVE-2026-19868)
- [VulDB - CVE-2026-19868 SonicWall SonicOS SSLVPN Service improper authentication](https://vuldb.com/vuln/432101)

## Full data

The other 8 detection rules (Splunk SPL / Microsoft KQL / Sigma) unlock with TL Creds; a free account includes daily creds: https://threadlinqs.com/?modal=signup
Indicator values unlock with TL Creds, at a lower price on Red and Purple; AI agents can query rules and IOCs through the Threadlinqs MCP server (Purple): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-5447