SonicWall VPN Bug Can Bypass SAML MFA: Patch by Nov...

A SonicWall firewall that says "SAML required" on its VPN login may not be enforcing it for everyone. CISA added a SonicOS SSLVPN flaw, CVE-2026-19868, to its Known Exploited Vulnerabilities catalog on November 6, and set a remediation deadline of November 20. According to SecurityWeek, an attacker who holds credentials for a different login method can get past the SAML checks, including SAML-enforced MFA. That means the sign-in screen can look protected while a side door stays open.

The patch exists. The reason to care this week is that "known exploited" means attackers are already using it, and a small business with a remote-access VPN is exactly the kind of target that gets scanned in bulk. Federal deadlines are written for agencies, but they are a useful clock for everyone else, because they mark the point where the government has decided waiting is no longer defensible.

The same news cycle carried a second, quieter warning. Apiiro reported more than a thousand public GitHub files exposing secrets that an AI coding tool had saved after a developer clicked "Don't Ask Again." Both stories share a pattern: a convenient shortcut for trust, left in place, becomes the way in. If you run a SonicWall, patch it. If anyone on your team or a contractor uses Claude Code, check their repos.

What happened

The analysis in this post comes from Apprised.news desk briefs, mainly the tech and cyber desk's November 8 brief and its November 9 follow-up. Each fact below links to the original reporting those briefs cite. Where the briefs add interpretation, I say so.

CISA listed the SonicWall bug. CISA added SonicWall SonicOS SSLVPN vulnerability CVE-2026-19868 to its KEV catalog on November 6, per the desk's November 8 brief.
What the flaw does. SecurityWeek reported it can let attackers who hold credentials for a different login method get past SAML checks, including SAML-enforced MFA.
A fix is out. The same SecurityWeek piece is headlined "SonicWall patches exploited SonicOS bug that weakens VPN logins," so SonicWall has shipped a patch.
The deadline. The desk's November 9 brief lists the CISA remediation date for CVE-2026-19868 as 2026-11-20. It also lists an unrelated Apple flaw, CVE-2024-27834, due 2026-11-18.
The AI coding file leak. Apiiro reported 1,122 public GitHub files exposing secrets saved by Claude Code's "Don't Ask Again" option. The desk says passwords and keys were left in public copies. The Hacker News covered the same finding.
The third-party angle. BleepingComputer reported that a French bank, Crédit Mutuel Arkéa, was hit through a service provider, enabling fraudulent transactions of up to $133 million. The desk reads that as one more case of trusted third-party access becoming the attack path.

Two caveats the desk itself raises. First, the briefs are analysis of public reporting, not independent testing, and I have not verified the exploit details myself. Second, the desk says it is watching for exploitation reporting and any update to the ransomware-use flag on this CVE before the deadline, so the picture may change. The desk's weighted read is short: patch the VPN, audit agent permission files, and treat vendor credentials as crown jewels.

What it means for a small business

You are exposed if you run a SonicWall firewall with SSLVPN turned on, especially if you rely on SAML single sign-on (Microsoft Entra, Okta and similar) as your MFA. The risk described is not that SAML is broken everywhere. It is that other login methods on the same VPN, such as local accounts or RADIUS, may still be enabled, and an attacker with a password for one of those can reach a session without the MFA prompt you think everyone sees.

You are indirectly exposed if an outside IT provider manages the firewall, because you may not know the model, the version, or who holds the admin credentials. And you are exposed on the second front if developers or contractors use AI coding agents and publish to GitHub.

A 25-person dental group in Ohio

The group runs a SonicWall with SSLVPN and Microsoft SAML sign-in for remote staff who open patient files from home. The office manager checks the firmware version on Monday and finds it is a build older than the patched release. She schedules the update for Tuesday evening, after the last appointment, then pulls 30 days of VPN login logs to look for sessions that skipped the MFA prompt.

The arithmetic is lopsided. Two hours of IT time, say 2 hours at an outside rate of $150 an hour, is $300. Compare that with the cost of a breach touching patient records. Even a modest notification and response bill for a few thousand records runs well past $300 on any realistic scale, before you count downtime and the phone calls. The patch is the cheap part.

A 60-employee machine shop

An outside IT contractor manages the SonicWall remotely, and the contractor's own admin account uses a shared password with no MFA. That is the Arkéa pattern in miniature: the vendor's access is the weak link, not the firewall's logic. The owner asks for the firmware version in writing, requires a named, MFA-protected admin account for the contractor, and puts November 18 on the calendar, two days before the CISA deadline, to confirm the patch is done.

The cost here is a few emails and a calendar entry. If the contractor pushes back on a named account, that is information about how the contractor handles your access.

A 6-person web design agency

The agency uses Claude Code and pushes client projects to public GitHub repos. A developer ticked "Don't Ask Again" on permissions months ago. The owner searches every repo for the agent settings folder and any saved commands that contain API keys. Three keys turn up. She rotates all three, then adds a pre-commit secret scan so it can't recur.

Time spent: one afternoon, call it 4 hours. What it avoids is exposure of client hosting and payment API keys. Rotating three keys costs minutes each. Cleaning up after a leaked hosting key on a client account costs far more and costs you the client's trust as well.

What to do this week

Find out if you run a SonicWall with SSLVPN. Check the device admin page or ask your IT provider. Get the model and SonicOS version in writing.
Compare your version to SonicWall's patched release for CVE-2026-19868 and apply the update. Do it before November 20, and do not leave it for the last day.
Ask whether other login methods are still enabled on the VPN portal. If you use SAML, find out about local accounts and RADIUS, and disable any you do not need.
Review VPN logs for the past 30 to 60 days after patching. Look for logins that did not trigger an MFA prompt, logins from unusual countries or hours, and any new local accounts. Rotate passwords for anyone flagged.
Require MFA on every admin account for the firewall and for any outside vendor. Ask the vendor to confirm in writing who holds credentials to your network.
Search your repos for AI agent settings files. Public and private, if anyone uses Claude Code. Look for saved commands containing passwords, tokens or API keys, remove them from history, and rotate any secret that appeared.
Turn off blanket "Don't Ask Again" approvals on machines that touch customer data or production systems. Turn on secret scanning in GitHub or a pre-commit hook. AGENTS.md: The Root-Level README That AI Coding Agents Actually Read explains the files agents pick up from a repo, which helps you know what to look for.
Put November 18 and November 20 on the calendar. Ask your IT provider for a one-line confirmation that the patch is installed and verified.

Two free tools help with the surrounding hygiene. The email breach check tells you whether staff addresses already appear in known breaches, which matters when an attacker is trying credentials. The DNS and email audit is a quick look at your mail authentication while you are already in a security mindset.

Copy-paste prompts

Use these with your own documents and data in hand. Each tells the AI to say when it is unsure, because a confident wrong answer about a firewall is worse than none.

Use this first, when you are not sure what you run:

I run a small business with about [number] employees and I think we use a SonicWall firewall with SSLVPN. I will paste our device details, admin screenshots or IT provider emails below. Using only what I paste, write a plain-English checklist to confirm the model, the SonicOS version, whether SSLVPN is on, and whether we use SAML or another login method. Then list the exact questions to ask my IT provider by email. If something I pasted is ambiguous or missing, say so instead of guessing.

Use this when a contractor gives you a vague answer:

My IT contractor says our SonicWall is "probably patched" for CVE-2026-19868. Here is their last message: [paste]. Draft a polite email asking for written proof: firmware version before and after, date of the update, whether any non-SAML login methods remain enabled on the VPN, and confirmation that admin accounts have MFA. Do not assume facts not in their message. If you are unsure what the CVE affects, say so and tell me to check the vendor advisory.

Use this to understand the flaw and read your logs:

Explain in simple terms what it means that an attacker with credentials for one login method might get past SAML-enforced MFA on a VPN. Then, working only from the VPN log excerpt I paste below, point out entries that look like logins without an MFA prompt, odd locations or hours, or new accounts. Quote the lines you flag. If the log format does not let you tell whether MFA ran, say that plainly rather than guessing.

Use this if anyone on your team uses Claude Code:

I use Claude Code for a small project and have clicked "Don't Ask Again" on some permissions. Walk me step by step through finding any saved settings or permission files in my repos, checking whether they contain passwords or API keys, removing them from Git history, and rotating the secrets. I will paste directory listings and file contents as we go. Tell me when you are unsure what a file does, and do not ask me to paste a real secret if a redacted version will do.

Use this to set a vendor access policy after reading the Arkéa story:

Using the list of vendors and access types I paste below, create a one-page vendor access policy for a 20-person company covering: who gets VPN or admin access, MFA required for every vendor account, how access is removed when a contract ends, and a quarterly review. Keep it under 300 words. Flag any vendor in my list where my information is incomplete.

Download the kit

The kit is a printable checklist and worksheet set: a SonicWall and VPN exposure checklist, a patch tracking table with the November 20 deadline, an email template for IT providers, a VPN log review worksheet, a vendor access register, a Claude Code file audit with a secret rotation log, and a 30-minute and 2-hour response plan. Grab it here: VPN Patch and Secret Leak Response Kit.

Fact-check notes and sources

Apprised.news tech desk, November 8: the KEV listing on November 6, the SAML-bypass description, the Claude Code file count, the Arkéa third-party read, and the desk's weighted read. analysis page
Apprised.news tech desk, November 9: the November 20 deadline for CVE-2026-19868, the November 18 Apple date, and the desk's statement that patching the SonicWall flaw is the more actionable item. analysis page
SecurityWeek: the report that the flaw can let attackers with credentials for another login method get past SAML checks, and that SonicWall has patched it. SecurityWeek
Apiiro: the count of 1,122 public GitHub files exposing secrets saved via "Don't Ask Again." Apiiro
The Hacker News: independent coverage of the same Claude Code finding. The Hacker News
BleepingComputer: the service-provider route into Crédit Mutuel Arkéa and the up to $133 million figure. BleepingComputer
Not independently verified: I have not confirmed the exact patched SonicOS version numbers or whether any ransomware group is using this CVE. Check SonicWall's own advisory and CISA's KEV entry for current details.

SonicWall VPN Bug Can Bypass SAML MFA: Patch by Nov 20, Audit Claude Code Files