SonicWall Issues Emergency Updates for SSL-VPN MFA Bypass Flaw Exploited in Attacks
Seven vulnerabilities in SonicOS firewalls require immediate patching to prevent unauthorized network access
Key Takeaways
- SonicWall has released emergency security updates for seven SonicOS firewall vulnerabilities.
- An SSL-VPN authentication bypass flaw is being exploited in the wild and allows attackers to bypass MFA protections.
- The flaw affects SonicOS 7.1 and earlier versions.
- Users must update to the latest SonicOS version to protect against exploitation.
- No public CVE IDs were assigned; seven vulnerabilities are addressed in the update.
Quick answers
- What happened?
- SonicWall has released security updates addressing seven vulnerabilities in SonicOS firewalls, including a critical SSL-VPN authentication bypass flaw that has been exploited in the wild. The flaw allows unauthenticated remote attackers to bypass MFA protections on SSL-VPN gateways. Users running SonicOS 7.1 and earlier versions are urged to update immediately.
- Which products are affected?
- SonicOS firewalls, SonicOS 7.1 and earlier
- What should defenders do?
- Update SonicOS firewalls to the latest available version immediately. Apply security patches through SonicWall's support portal. Monitor for unusual SSL-VPN authentication attempts. Implement network segmentation to limit potential impact if patching is delayed.
SonicWall has released security updates to fix seven vulnerabilities in SonicOS firewalls, including an SSL-VPN authentication bypass flaw that has been exploited in attacks. According to the vendor, the flaw affects SonicOS 7.1 and earlier versions and allows unauthenticated remote attackers to bypass SSL-VPN authentication and gain access to the network. The vulnerability specifically targets MFA protections on SSL-VPN gateways, raising concerns about unauthorized network access. SonicWall's advisory confirms the flaw is being exploited in the wild, though specific attack details and threat actor attribution have not been disclosed. The company has not assigned CVE IDs to the vulnerabilities in this release. Users are advised to update to the latest SonicOS version available through SonicWall's support portal to mitigate the risk. The remaining six vulnerabilities' technical details were not specified in the initial advisory.
Security Details
The SSL-VPN authentication bypass flaw allows unauthenticated remote attackers to circumvent MFA protections on SSL-VPN gateways. Exploitation could enable unauthorized network access. The vulnerability affects SonicOS 7.1 and earlier versions. Seven total vulnerabilities were patched in this update, though only the SSL-VPN bypass was confirmed as exploited in the wild.
Affected products
SonicOS firewalls, SonicOS 7.1 and earlier
Mitigation
Update SonicOS firewalls to the latest available version immediately. Apply security patches through SonicWall's support portal. Monitor for unusual SSL-VPN authentication attempts. Implement network segmentation to limit potential impact if patching is delayed.
Sources
BleepingComputer
SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks
Nov 7, 2026 · 00:00
Original link
Related Security News
Race Condition in WordPress Core Update Process Leaves Sites Vulnerable During Patching
A race condition in the WordPress core update mechanism allows remote code execution on servers if an attacker strikes during the file unpacking phase. The update process uses legacy, unpatched code to unpack new files, creating a window of exposure even after a security fix is applied. Picus Security researcher Umut Bayram reported the issue, noting that active exploitation is occurring in the wild. The recommended mitigation is to block web access to the update directory during the patching process.
