SonicWall SonicOS SSL-VPN flaw (CVE-2026-19868) lets attackers bypass SAML and MFA; exploited, on CISA KEV
https://sockanalyst.com/patch-now/sonicwall-sonicos-sslvpn-saml-mfa-bypass-cve-2026-19868

Splunk
index=firewall sourcetype="sonicwall*" (msg="*SSL VPN*" OR msg="*SSLVPN*") (msg="*login*" OR msg="*logged in*")
| eval auth_method=coalesce(auth_method, auth, method)
| search NOT auth_method="*SAML*"
| lookup saml_only_vpn_users user OUTPUT saml_only
| where saml_only="true" OR isnull(auth_method)
| stats count min(_time) as first max(_time) as last values(src) as src_ip values(auth_method) as auth_method by user, dvc
// SSL-VPN successes for SAML-only users that did NOT go through SAML = possible CVE-2026-19868 bypass

Sentinel
let vpn = CommonSecurityLog
| where TimeGenerated > ago(30d) and DeviceVendor has "SonicWall"
| where Activity has_any ("SSL VPN","SSLVPN") and Activity has_any ("login","logged in")
| extend User = tolower(coalesce(SourceUserName, DestinationUserName))
| project VpnTime=TimeGenerated, User, SourceIP, DeviceName, Activity;
let idp = SigninLogs
| where TimeGenerated > ago(30d) and ResultType == 0
| extend User = tolower(UserPrincipalName)
| project IdpTime=TimeGenerated, User;
vpn
| join kind=leftouter idp on User
| where isnull(IdpTime) or abs(datetime_diff('minute', VpnTime, IdpTime)) > 10
| summarize Logins=count(), FirstSeen=min(VpnTime), LastSeen=max(VpnTime), IPs=make_set(SourceIP) by User, DeviceName
// VPN logins with no matching IdP/SAML sign-in near the same time