Vulnerability · CVE-2026-19868

SAML is not the only door on SonicOS SSLVPN.

Added to KEV on 6 November 2026. Federal due date 20 November. The public description is narrower than "the VPN is open."

What CISA actually wrote

The 6 November alert names a use-of-single-factor flaw: a user who already holds a valid credential for an alternate authentication method can bypass SAML controls on SonicOS SSLVPN. The catalog text also says that bypass can extend to SAML itself.

Read that again before you brief it as an unauthenticated remote hole. The precondition in the public text is a credential the appliance already accepts by another method. Local users, an old LDAP bind, a leftover one-time-password profile: those are the questions. "Anyone on the internet" is a different bug, and it is not this sentence.

What to inventory

Which SonicWall devices terminate SSLVPN, and which of those are reachable from networks you do not control.
Which accounts are supposed to be SAML-only.
Which other methods those same accounts can still complete: local, RADIUS, LDAP, certificate, or a break-glass user nobody rotated.

A SAML button on the portal does not answer the third question. The appliance answers it, in the authentication profile.

What to read in the log

For accounts that policy says are SAML-only, list successful VPN sessions whose method is not SAML. Start the window before 6 November, not on the day you patch. A side door that has been open for a year is a configuration finding. A side door that appears the week of the catalog entry is a different finding. The fields worth keeping are account, time, method, and source address. See the detection note for the comparison, without a product query pasted in.

The build number is not on this page

SonicWall's advisory carries the firmware build. We are not going to type a version we did not read off that advisory into a static snapshot. After the build is on the device, check with an account you own: the alternate method should fail closed for anyone policy marks as SAML-only. A successful alternate login after the patch means the patch is not the change you thought it was.

Absence of the ransomware flag, as of catalog 2026.11.06, is not a reason to use the fourteen days. It means CISA had not attached that flag. The due date is 20 November.