A remote access policy is only as effective as the login paths that enforce it. This week, Saudi alerts on SonicWall and OpenSSH give managed providers and software teams two different paths to check. A Saudi cloud launch adds a procurement question for the same teams: where do security alerts and support records go after they leave the customer’s environment?
SonicWall SSL VPN users should check alternate logins
Saudi Arabia’s National Cybersecurity Authority issued a SonicWall alert on 6 November. SonicWall published CVE-2026-19868 the same day, and CISA added it to its Known Exploited Vulnerabilities Catalog. An attacker with valid credentials for an alternate authentication method may bypass SAML checks, including multi-factor authentication enforced through SAML. The listing establishes known exploitation. The public records cited here give no attack date or GCC victim details. [1][2][3]
SonicWall’s version table lists Gen 7 builds through 7.3.3-7015 and Gen 8 builds through 8.2.2-8015 as affected. The fixed builds listed are 7.3.4-7013 or later for Gen 7 and 8.2.3-8015 for Gen 8. The first fixed Gen 7 build was available on 20 October. The new developments are the November disclosure and the evidence of exploitation. The Gen 8 release notes identify the authentication fix. [4][5]
For an MSP or MSSP, start with appliances that expose SSL VPN and confirm the applicable firmware for each model. After updating, test the intended SAML and MFA flow and any alternate login path still enabled. Review VPN sign-in records for unexpected sessions and preserve relevant evidence if compromise is suspected. An unauthorised session could expose internal services that the affected account can reach. [2][3][4]
OpenSSH exposure depends on the server configuration
Portable OpenSSH 10.6p2 shipped on 5 November with a workaround for CVE-2026-123158. Saudi NCA published its alert on 6 November. The issue affects certain Linux servers using the musl C library without PAM when password login is enabled. Alpine’s advisory explains that the account and password-hash configuration must also meet specific conditions. On 8 November, SANS Internet Storm Center reported observing an attempt against its sensors on 5 November. That observation concerns attack traffic to sensors. [6][7][8][9]
A software house should check the bastion hosts, build runners and customer appliances where the SSH server actually runs. An Alpine container without sshd falls outside this particular exposure. Use the distribution’s fixed package for the installed branch. For example, Alpine 3.24 lists openssh 10.3_p1-r2 as fixed. Restart the daemon after updating. If an upgrade must wait, Alpine advises disabling password authentication and restarting sshd. Verify key access first and keep a working session open until the new login succeeds. An exposed account with administrative privileges could give an attacker control of the host and access to credentials it can read. [7][8]
CrowdStrike announces a Saudi cloud deployment
On 4 November at Fal.Con Europe in Barcelona, CrowdStrike announced that its Saudi Falcon deployment was immediately available to customers and authorised partners. The company says the deployment hosts Falcon security workloads, customer telemetry and management infrastructure in Saudi Arabia. These are the categories described in the launch announcement. [10]
For an MSSP evaluating the deployment, trace a sample alert from the Saudi tenant into the ticketing system and through a support escalation. Ask the provider to document which service tiers use the Saudi deployment, where copies and exports go, and what access support staff have. Include retention, backups and any AI processing in the written requirements if they matter to the buyer. The answers can affect whether a proposal meets the customer’s data-handling requirements and whether an existing integration needs to change. [10][11]
Three actions for this week
- Confirm VPN coverage. Record the running build per appliance and test which sign-in routes enforce the customer’s MFA policy. [2][4][5]
- Close the SSH finding with evidence. Record the fixed package, confirm sshd restarted and verify that authorised administrators can still connect. [7][8]
- Check a sample alert before quoting. Document which systems receive it, where it is retained and who can open it during support. [10][11]
A question for a partner’s customer meeting: “Can we follow one remote login and one security alert from start to finish, and see which controls and providers are involved?”
If you need to verify how an application handles login and authorisation, bring an approved scope to Nordic Defender for penetration testing and retesting. Delivery partners can bring a customer-approved scope and discuss how to divide testing, remediation and reporting responsibilities. [12]
Sources
All sources were checked on 9 November 2026.
1. SonicWall Alert 2026-7999 — Saudi National Cybersecurity Authority. 6 November 2026.
2. CVE-2026-19868 — SonicWall CNA record, CVE Program. Published 6 November 2026, updated 7 November 2026.
3. Known Exploited Vulnerabilities Catalog — CVE-2026-19868 — CISA official JSON feed. Entry added 6 November 2026.
4. SonicOS 7.3.4 and 8.2.3 Security Advisory — SonicWall. Published 3 November 2026, updated 6 November 2026.
5. SonicOS 8 Release Notes — Version 8.2.3-8015 — SonicWall. November 2026.
6. OpenSSH Alert 2026-7996 — Saudi National Cybersecurity Authority. 6 November 2026.
7. Portable OpenSSH 10.6p2 release notes — OpenSSH Project. 5 November 2026.
8. Security advisory — openssh-server password authentication bypass — Alpine Linux. 5 November 2026.
9. Scans for Sshole Vulnerability (CVE-2026-123158) — SANS Internet Storm Center. Published and updated 8 November 2026.
10. CrowdStrike Launches Sovereign Cloud in Saudi Arabia — CrowdStrike Investor Relations. 4 November 2026.
11. NIST SP 1305 — Quick-Start Guide for Cybersecurity Supply Chain Risk Management — NIST. October 2024.
12. Penetration Testing as a Service — Nordic Defender. Undated.