# VPN Patch and Secret Leak Response Kit

**Purpose.** This kit helps a small business do three things before CISA's November 20 deadline for SonicWall SonicOS SSLVPN flaw CVE-2026-19868: find out whether it runs an affected SonicWall, patch and verify the fix, and check whether anyone has already gotten in. It also covers the related risk of AI coding agent files leaking secrets into public GitHub repos. Print it, fill it in with your IT provider, and keep the finished copy as your record. It is a checklist and worksheet set, not a substitute for SonicWall's own advisory.

## Part 1: Exposure checklist

- [ ] Confirm in writing whether we own a SonicWall firewall (model and serial number).
- [ ] Record the current SonicOS version from the device admin page.
- [ ] Confirm whether SSLVPN is enabled on the device.
- [ ] Confirm whether VPN logins use SAML (for example Microsoft Entra or Okta).
- [ ] List every other login method still enabled on the VPN portal (local accounts, RADIUS, others).
- [ ] Disable any login method we do not need.
- [ ] Read SonicWall's advisory for CVE-2026-19868 and note the patched release number.
- [ ] Apply the patch and record the date, the person, and the new version.
- [ ] Ask the IT provider for a one-line written confirmation that the patch is installed and verified.
- [ ] Confirm every firewall admin account, including vendor accounts, has MFA.
- [ ] Put November 18 and November 20 on the calendar as check-in dates.

## Part 2: Patch tracking table

| Device | Model | Current version | Target version | Owner | Date done | CISA deadline |
|---|---|---|---|---|---|---|
| | | | | | | 2026-11-20 |
| | | | | | | 2026-11-20 |
| | | | | | | 2026-11-20 |

Note: add a row for each device. If a device cannot be patched, write the reason and the compensating step (for example, VPN disabled until patched).

## Part 3: Email template to IT providers

```text
Subject: Written confirmation needed: SonicWall CVE-2026-19868

Hi [name],

CISA has set a November 20 remediation deadline for CVE-2026-19868 in SonicWall SonicOS SSLVPN. Please reply in writing with:

1. Our SonicWall model and the SonicOS version before and after the update.
2. The date the update was or will be applied.
3. Whether any login method other than SAML (local accounts, RADIUS) is still enabled on the VPN, and if so why.
4. Confirmation that every admin account on the firewall has MFA.
5. A list of every person or company that holds admin credentials to our network.
6. Whether you reviewed VPN logs for the past 30 to 60 days for logins that skipped MFA, and what you found.

If any answer is "not sure," please say so rather than estimate.

Thanks,
[name]
```

## Part 4: VPN log review worksheet

Review 30 to 60 days of logs after patching. Record each finding.

| Date and time | Username | Source IP and country | Login method | MFA prompt shown? | Why it looks odd | Action taken |
|---|---|---|---|---|---|---|
| | | | | | | |
| | | | | | | |
| | | | | | | |

Things to look for:

- [ ] Logins that did not trigger an MFA prompt.
- [ ] Logins from countries where we have no staff.
- [ ] Logins at hours when the account holder is never working.
- [ ] New local accounts created recently.
- [ ] Repeated failed logins followed by a success.
- [ ] Logins using a method we thought was disabled.
- [ ] For every flagged user, rotate the password and re-register MFA.

## Part 5: Vendor access register

| Vendor | Contact | What they can reach | Account name | MFA on? | Date granted | Review date | Date removed |
|---|---|---|---|---|---|---|---|
| | | | | | | | |
| | | | | | | | |

Rules: one named account per person, no shared passwords, MFA on every vendor account, access removed the day a contract ends, register reviewed every quarter.

## Part 6: Claude Code and AI agent file audit

- [ ] List every repo, public and private, that anyone on the team or a contractor has used an AI coding agent in.
- [ ] In each repo, search for agent settings and permission folders and files.
- [ ] Open any saved commands or approvals and check for passwords, tokens or API keys.
- [ ] Check Git history, not just the current files, for the same items.
- [ ] Remove any found secret from history and force the repo to be cleaned.
- [ ] Rotate every secret that appeared, even if you think nobody saw it.
- [ ] Turn off blanket "Don't Ask Again" approvals on machines that touch customer data or production.
- [ ] Turn on secret scanning in GitHub or add a pre-commit secret scan.
- [ ] Add the settings folder to the ignore list so it is not committed again.

### Secret rotation log

| Secret (name only, never the value) | Where found | Date found | Rotated by | Date rotated | Old one revoked? |
|---|---|---|---|---|---|
| | | | | | |
| | | | | | |
| | | | | | |

## Part 7: Response plans if compromise is suspected

**First 30 minutes**

- [ ] Do not reboot or wipe the firewall yet; note the time and what you saw.
- [ ] Disable SSLVPN access, or restrict it to a short allowlist, until patched.
- [ ] Reset passwords and MFA for any flagged account.
- [ ] Revoke any session still open for flagged accounts.
- [ ] Call your IT provider and tell them in plain words what you saw.
- [ ] Write down who knows, and who has been told what.

**Within 2 hours**

- [ ] Export the firewall and VPN logs to a safe location before anything rolls over.
- [ ] Patch the device and verify the new version.
- [ ] Rotate admin passwords and any shared secrets.
- [ ] Check for new local accounts and remove ones you do not recognise.
- [ ] Identify what the flagged accounts could reach and review that data's access logs.
- [ ] Check your cyber insurance policy for notice requirements and the claims number.
- [ ] Decide whether customer, patient or employee data may be involved, and ask counsel about notification duties.

## Part 8: Paste-ready AI prompts

Prompt 1, confirm what we run:

```text
I run a small business with about [number] employees and I think we use a SonicWall firewall with SSLVPN. I will paste our device details, admin screenshots or IT provider emails below. Using only what I paste, write a plain-English checklist to confirm the model, the SonicOS version, whether SSLVPN is on, and whether we use SAML or another login method. Then list the exact questions to ask my IT provider by email. If something I pasted is ambiguous or missing, say so instead of guessing.
```

Prompt 2, demand written proof:

```text
My IT contractor says our SonicWall is "probably patched" for CVE-2026-19868. Here is their last message: [paste]. Draft a polite email asking for written proof: firmware version before and after, date of the update, whether any non-SAML login methods remain enabled on the VPN, and confirmation that admin accounts have MFA. Do not assume facts not in their message. If you are unsure what the CVE affects, say so and tell me to check the vendor advisory.
```

Prompt 3, read the logs:

```text
Explain in simple terms what it means that an attacker with credentials for one login method might get past SAML-enforced MFA on a VPN. Then, working only from the VPN log excerpt I paste below, point out entries that look like logins without an MFA prompt, odd locations or hours, or new accounts. Quote the lines you flag. If the log format does not let you tell whether MFA ran, say that plainly rather than guessing.
```

Prompt 4, audit agent files:

```text
I use Claude Code for a small project and have clicked "Don't Ask Again" on some permissions. Walk me step by step through finding any saved settings or permission files in my repos, checking whether they contain passwords or API keys, removing them from Git history, and rotating the secrets. I will paste directory listings and file contents as we go. Tell me when you are unsure what a file does, and do not ask me to paste a real secret if a redacted version will do.
```

Prompt 5, vendor access policy:

```text
Using the list of vendors and access types I paste below, create a one-page vendor access policy for a 20-person company covering: who gets VPN or admin access, MFA required for every vendor account, how access is removed when a contract ends, and a quarterly review. Keep it under 300 words. Flag any vendor in my list where my information is incomplete.
```

## Sources

- https://apprised.news/desk/tech/2026-11-08
- https://apprised.news/desk/tech/2026-11-09
- https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
- https://apiiro.com/blog/coding-agents-leaking-secrets-github-dont-ask-again
- https://thehackernews.com/2026/11/claude-codes-dont-ask-again-file.html
- https://www.bleepingcomputer.com/news/security/hackers-pull-off-133-million-french-bank-heist-via-service-provider/