When a business turns on multifactor authentication (MFA) for remote access, the usual test is simple: sign in through the company identity provider and check that a second factor is required. That test answers one question about one route. The latest SonicOS SSL VPN advisory is a reason to ask a second question: can anyone still reach the same network through a different login route?
On 6 November 2026, the US Cybersecurity and Infrastructure Security Agency (CISA) added CVE-2026-19868 to its Known Exploited Vulnerabilities catalog. Its entry describes a SonicWall SonicOS SSL VPN weakness that can let a user with valid credentials for an alternative authentication method bypass SAML controls, potentially bypassing MFA enforced through SAML. The entry is evidence of exploitation in the wild. It does not establish that any particular Malaysian company was compromised, and CISA lists ransomware use as unknown.
Identify the firewall and the service first
Ask your IT team or managed service provider for the appliance model, exact running firmware build, and whether it serves SSL VPN users. Check branches, virtual firewalls and standby equipment as well as head office. The SonicOS advisory concerns firewall software; do not use an inventory or patch plan for the separate SMA 1000 product to decide whether a SonicOS firewall is covered.
SonicWall’s release notice, published 3 November and updated 6 November 2026, identifies SonicOS 7.3.4 for Gen 7 and 8.2.3 for Gen 8 as the release families containing fixes for the advisory bundle. Have the person performing the change check the precise affected and fixed builds and model-specific upgrade path against SNWLID-2026-0014. A firewall generation or a major version number by itself is not sufficient evidence that the device is fixed. If the appliance is out of support, agree how to move remote access off it rather than waiting indefinitely for a firmware update.
Look for the route your normal test misses
List the login methods and user groups that can reach SSL VPN, including any local or directory accounts retained for exceptions. Record which identity provider policy covers each permitted route and where MFA is enforced. A working SAML challenge tells you how the intended path behaves. Check separately that any alternative method that should be unavailable is actually denied from an external test connection.
Hypothetical example: a Selangor wholesaler uses SAML for staff and still has a legacy local VPN account for weekend maintenance. Its IT team tests with an authorised account and a pre-agreed change window, documents who owns the exception and checks that a retired route can no longer be used. Staff then verify that their normal VPN session reaches the inventory system. This example illustrates the review; it is not a reported incident.
Set a change window and a decision if it slips
Give the firmware change a named owner and an agreed time, with a configuration backup and a way to reach the appliance if remote administration becomes unavailable. For a high availability pair, confirm that the plan covers both nodes. Document how staff will work if remote access needs to be suspended. If the fix cannot be applied promptly, ask the technical owner which vendor-supported measures can limit exposure. Consider suspending the affected SSL VPN service if there is no safe mitigation and arrange an approved alternative for essential users.
After the change, capture the running build, verify the intended MFA challenge, test denial of disallowed paths and check one real business workflow. Ask for the results in the change ticket. CISA’s catalog deadline is a US federal remediation date; a Malaysian SME can set its own earlier deadline based on exposure and business dependence.
Keep investigation separate from the patch
A firmware update reduces future exposure. It does not tell you what happened before it was installed. Preserve available VPN, firewall and identity provider logs. Ask the responder to compare successful VPN sessions with expected users, source locations, operating hours and corresponding identity provider events where those should exist. An unmatched entry is a lead to investigate, not proof of compromise. If the evidence suggests unauthorised access, follow your incident response process and establish the scope before returning affected accounts and systems to ordinary use.
For a focused discussion about your firewall inventory, remote access and what to test after an update, contact AXO Technologies.
Sources and dates
Published 9 November 2026. Sources accessed 9 November 2026.
- CISA Known Exploited Vulnerabilities catalog — CVE-2026-19868 added 6 November 2026.
- SonicWall Gen 7 and Gen 8 security release notice — published 3 November 2026, updated 6 November 2026.
- SonicWall PSIRT advisory SNWLID-2026-0014 — vendor guidance and version scope.