SonicWall Patches SSL-VPN MFA Bypass Flaw Already Under Active Exploitation

SonicWall has released firmware updates for SonicOS addressing seven vulnerabilities, including an SSL-VPN authentication bypass flaw that attackers are already exploiting, according to a report from BleepingComputer.

What was reported

SonicWall's advisory covers seven SonicOS flaws. One allows bypassing SSL-VPN multi-factor authentication, and SonicWall has confirmed it is being actively exploited in attacks. Specific technical details of the bypass mechanism, affected firmware version ranges, and CVE identifiers were not included in the source material reviewed here.

Why it matters

SonicWall SSL-VPN appliances are widely used as remote-access gateways. An MFA bypass on this surface is serious. MFA is typically the control organizations rely on to blunt credential theft and password spraying, so a flaw that defeats it can turn a stolen or guessed password into remote access. Because exploitation is already confirmed, any organization running SonicOS-based SSL-VPN should treat this as an active threat.

What defenders should do now

• Identify all SonicWall firewalls with SSL-VPN enabled and prioritize patching to the fixed SonicOS firmware version as soon as SonicWall publishes it.
• Review SSL-VPN authentication logs for anomalies such as successful logins that skip the expected MFA challenge, logins from unexpected geographies, or a spike in VPN session establishments outside normal patterns.
• Hunt for post-authentication activity from VPN-assigned IP ranges, including lateral movement, new remote access tool installs, or unusual LDAP/AD queries shortly after a VPN session starts.
• Where patching cannot happen immediately, consider restricting SSL-VPN access by source IP allowlist, disabling SSL-VPN where it is not actively needed, and tightening session and token lifetimes.
• Check for any SonicWall-published indicators of compromise or exploitation guidance once released, and correlate against existing VPN and firewall logs.

Developing situation

This is new, developing intelligence. SonicWall and BleepingComputer have not yet published full technical detail on the bypass mechanism or CVE assignment at the time of this writing. Defenders should monitor for updates and treat this advisory as high priority given confirmed in-the-wild exploitation. Read the original report at BleepingComputer.