Vulnerability ManagementNetwork SecuritySOC
SonicWall has released updates for seven SonicOS vulnerabilities, and one of them, CVE-2026-19868, is an SSL-VPN authentication bypass that SonicWall says it has investigated a report of being exploited. According to BleepingComputer, published 6 November 2026, the flaw lets an attacker who holds valid credentials for an alternate authentication method bypass SAML authentication controls, potentially including SAML-enforced multi-factor authentication. CISA has added it to the Known Exploited Vulnerabilities catalog and told federal civilian agencies to secure affected systems by 20 November 2026.
The same release addresses six further SonicOS issues, none with a CVE ID in the report: two management-interface flaws rated 8.8 that can let unauthenticated attackers perform unauthorised operations "under specific conditions", pre-authentication buffer overflows in the SSL-VPN and TACACS+ services that can cause denial of service, and a weak password hashing issue affecting virtual appliances. The management-interface flaws are the reason to confirm that the admin interface is not reachable from the internet while you patch.
Most VPN alerting is built around failed logins and impossible travel. A bypass of SAML controls produces a successful login that looks normal: the right username, a valid alternate credential, a session established. The signal that something is wrong is not in the login result but in what is missing, namely the identity provider's record of the MFA step. That makes the first hours after patching a log-correlation problem, not a patching problem.
This follows a run of SonicWall exploitation this year. The same report points to attacks on SMA1000 appliances in July and September, and to a maximum-severity SMA1000 flaw exploited in October. Those are different products and different bugs, but they put the vendor's remote-access line on many attackers' target lists.
The hard step above is number three: joining VPN logs, identity provider events and endpoint activity, and deciding which logins to escalate. Obiguard SOC is our managed security operations service. Analysts monitor telemetry from sources such as firewalls and VPN gateways alongside identity and endpoint data, triage what looks wrong, and escalate with context, so a login that succeeded without a matching MFA event is reviewed by a person rather than waiting in a log. Scope matters: SOC does not patch your firewall or fix the underlying flaw, and it can only correlate the sources that are connected to it. Patch first; use monitoring to find out whether anyone used the gap before you did. To talk through coverage for your remote-access stack, get in touch.
Obiguard sits in front of every AI request your organization makes — screening prompts and outputs against the guardrails, compliance frameworks, and audit trails that stories like this one make necessary.
See how it works →