CVE-2026-19868: SonicWall SonicOS SAML Authentication Bypass — Detection, Hunting, and Remediation Guide

---
title: SonicWall VPN Login via Non-SAML Authentication Method
description: Detects successful SonicWall SSL VPN logins where the authentication method is local or non-SAML, indicating possible CVE-2026-19868 SAML bypass or policy drift.
references:
  - https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
  - https://attack.mitre.org/techniques/T1078/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 3b7e2f91-4c5a-4d8e-b6f1-9a2c7d4e5f60
tags:
  - attack.initial_access
  - attack.persistence
  - attack.t1078
  - attack.t1133
logsource:
  product: sonicwall
  category: firewall
detection:
  selection_login_success:
    message|contains:
      - 'User login successful'
      - 'logged in'
  selection_vpn:
    message|contains:
      - 'SSLVPN'
      - 'SSL-VPN'
      - 'Virtual Office'
  filter_saml:
    message|contains:
      - 'SAML'
  condition: selection_login_success and selection_vpn and not filter_saml
falsepositives:
  - Legitimate local admin logins for management (restrict source IPs via tuning)
  - Environments where SAML is not enforced for VPN (baseline first)
level: high
---
title: SonicWall Local or Break-Glass Account Authentication
description: Detects authentication using local SonicWall accounts, which should be rare in SAML-enforced environments and may indicate exploitation of CVE-2026-19868 with harvested local credentials.
references:
  - https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
  - https://attack.mitre.org/techniques/T1078.003/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 8c1d4a72-6b3f-4e9c-a2d5-7f8e1b3c9d42
tags:
  - attack.persistence
  - attack.t1078.003
  - attack.defense_evasion
logsource:
  product: sonicwall
  category: firewall
detection:
  selection:
    message|contains:
      - 'Local Database'
      - 'local user'
      - 'LocalUser'
  selection_auth:
    message|contains:
      - 'login'
      - 'authentication'
  condition: selection and selection_auth
falsepositives:
  - Documented break-glass account usage during IdP outages (correlate with change tickets)
level: high
---
title: SonicWall Admin or VPN Login from Untrusted Source Network
description: Detects SonicWall management or VPN authentication originating from source IPs outside expected geographies or known corporate egress ranges, a common post-bypass indicator.
references:
  - https://www.securityweek.com/sonicwall-patches-exploited-sonicos-bug-that-weakens-vpn-logins/
  - https://attack.mitre.org/techniques/T1133/
author: Security Arsenal
date: 2026/04/06
status: experimental
id: 5e9f3b18-2a7d-4c6e-9f41-3d8a6c2e7b15
tags:
  - attack.initial_access
  - attack.t1133
logsource:
  product: sonicwall
  category: firewall
detection:
  selection:
    message|contains:
      - 'login successful'
      - 'logged in'
  filter_expected_sources:
    src_ip|cidr:
      - '10.0.0.0/8'
      - '192.168.0.0/16'
      - '203.0.113.0/24' # Replace with your known corporate egress / trusted ranges
  condition: selection and not filter_expected_sources
falsepositives:
  - Remote administrators traveling; tune with an allowlist and geo-baseline
level: medium

// Hunt 1: Successful SonicWall VPN logins that did NOT go through SAML
// Baseline this against your environment — any hit in a SAML-enforced org is suspicious.
CommonSecurityLog
| where DeviceVendor =~ "SonicWall"
| where TimeGenerated > ago(30d)
| where Message has_any ("login successful", "logged in")
| where Message has_any ("SSLVPN", "SSL-VPN", "Virtual Office")
| where Message !has "SAML"
| extend SourceIP = tostring(SourceIP), User = coalesce(SourceUserName, extract(@"user[ =]([\w\.\-@]+)", 1, Message))
| summarize Logins = count(), FirstSeen = min(TimeGenerated), LastSeen = max(TimeGenerated)
  by User, SourceIP, DeviceName
| order by Logins desc

// Hunt 2: Local account usage on SonicWall appliances (Syslog table variant)
Syslog
| where TimeGenerated > ago(30d)
| where SyslogMessage has_any ("SonicWall", "sonicos")
| where SyslogMessage has_any ("login", "authentication")
| where SyslogMessage has_any ("Local Database", "local user", "LocalUser")
| project TimeGenerated, Computer, HostIP, SyslogMessage
| order by TimeGenerated desc

// Hunt 3: VPN session establishment followed by internal lateral movement within 1 hour
// Correlates SonicWall VPN logins with subsequent RDP/SMB admin-share activity on endpoints.
let VpnLogins =
  CommonSecurityLog
  | where DeviceVendor =~ "SonicWall"
  | where TimeGenerated > ago(7d)
  | where Message has "login successful" and Message has_any ("SSLVPN", "Virtual Office")
  | where Message !has "SAML"
  | extend AssignedIP = extract(@"([0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3}\.[0-9]{1,3})", 0, Message)
  | project LoginTime = TimeGenerated, AssignedIP, SourceIP, Message;
VpnLogins
| join kind=inner (
  DeviceNetworkEvents
  | where TimeGenerated > ago(7d)
  | where RemotePort in (3389, 445, 22, 5985)
  | extend AssignedIP = tostring(LocalIP)
) on AssignedIP
| where TimeGenerated between (LoginTime .. LoginTime + 1h)
| project LoginTime, SourceIP, AssignedIP, DeviceName, RemoteIP, RemotePort, InitiatingProcessFileName
| order by LoginTime desc

-- Hunt for common post-VPN-intrusion tooling executed on endpoints in the last 7 days
-- Focus: recon, tunneling, and remote access tools frequently staged after edge-device compromise
SELECT Pid, Ppid, Name, CommandLine, Exe, Username, CreateTime
FROM pslist()
WHERE CommandLine =~ '(?i)(nmap|masscan|netscan|adfind|nltest|net group .?domain admins|psexec|wmiexec|chisel|ligolo|ngrok|cloudflared|anydesk|screenconnect|teamviewer)'
  AND CreateTime > now() - 7 * 24 * 3600

-- Hunt SonicWall syslog files on a log collector for non-SAML VPN login evidence
-- Adjust the glob path to your collector's SonicWall log location
SELECT FullPath, Data.Line AS LogLine, Data.LineNumber AS LineNumber
FROM foreach(
  row={ SELECT FullPath FROM glob(globs='/var/log/remote/sonicwall/*.log') },
  query={
    SELECT FullPath, { SELECT Line, LineNumber FROM parse_lines(filename=FullPath)
           WHERE Line =~ '(?i)(login successful|logged in)'
             AND Line =~ '(?i)(sslvpn|ssl-vpn|virtual office)'
             AND NOT Line =~ '(?i)saml' } AS Data
    FROM scope()
  })

#!/bin/bash
# CVE-2026-19868 — SonicWall SonicOS verification & audit helper
# Run from a management host with SSH access to your SonicWall appliances.
# Requires: sshpass or key-based auth, and an inventory file (one appliance IP per line).

INVENTORY="sonicwall_appliances.txt"   # one management IP per line
USER="admin"                            # use a read-only/auditor account where possible
OUTDIR="./cve-2026-19868-audit-$(date +%Y%m%d)"
mkdir -p "$OUTDIR"

# 1. Pull firmware/build version from each appliance and flag for comparison
#    against the fixed release listed in SonicWall PSIRT advisory for CVE-2026-19868.
while read -r FW; do
  echo "[*] Querying $FW ..."
  ssh -o StrictHostKeyChecking=no "$USER@$FW" "show version" \
    > "$OUTDIR/${FW}_version.txt" 2>/dev/null
  grep -iE 'SonicOS|firmware|build' "$OUTDIR/${FW}_version.txt"
done < "$INVENTORY"

# 2. Export full configuration for offline auth-method audit
while read -r FW; do
  ssh -o StrictHostKeyChecking=no "$USER@$FW" "show current-config" \
    > "$OUTDIR/${FW}_config.exp" 2>/dev/null
done < "$INVENTORY"

# 3. Offline audit: find local user accounts with VPN privileges and non-SAML realms
echo "=== Local users present in configs ==="
grep -riE 'user-local|local-user' "$OUTDIR"/*_config.exp | sort -u

echo "=== Auth methods / domains configured ==="
grep -riE 'authentication method|user domain|saml|ldap|radius' "$OUTDIR"/*_config.exp | sort -u

echo ""
echo "[!] ACTION ITEMS:"
echo "    1. Compare firmware versions above to the fixed build in the SonicWall PSIRT advisory."
echo "    2. Disable or remove local user accounts with SSL VPN access unless documented break-glass."
echo "    3. Enforce SAML as the sole auth method on the VPN user domain; remove fallback methods."
echo "    4. Review the last 30+ days of VPN auth logs for non-SAML successful logins."

# CVE-2026-19868 — quick SonicOS API audit from a Windows jump host
# Note: SonicOS API availability depends on firmware generation; enable it on a
# dedicated management interface only, and use an auditor-scoped account.

$Appliances = Get-Content "C:\audit\sonicwall_appliances.txt"
$Cred = Get-Credential  # auditor account
$Report = @()

foreach ($fw in $Appliances) {
    try {
        # Firmware / version check (endpoint naming varies by SonicOS generation)
        $ver = Invoke-RestMethod -Uri "https://$fw/api/sonicos/version" `
               -Credential $Cred -SkipCertificateCheck -TimeoutSec 15
        # Local user enumeration
        $users = Invoke-RestMethod -Uri "https://$fw/api/sonicos/user/local/users" `
                 -Credential $Cred -SkipCertificateCheck -TimeoutSec 15
        $Report += [pscustomobject]@{
            Appliance   = $fw
            VersionInfo = ($ver | ConvertTo-Json -Compress)
            LocalUsers  = ($users | ConvertTo-Json -Compress)
            QueriedAt   = Get-Date
        }
    } catch {
        Write-Warning "$fw query failed: $($_.Exception.Message)"
    }
}

$Report | Export-Csv "C:\audit\cve-2026-19868-audit.csv" -NoTypeInformation
Write-Host "Review output for: (a) firmware below the patched build, (b) local users with VPN rights, (c) non-SAML auth methods on VPN domains."