SonicWall SonicOS: SSL-VPN MFA bypass exploited in attacks, firmware update needed

What happened

On 6 November 2026, SonicWall released updates for seven vulnerabilities in SonicOS, the operating system of its firewalls. One of them is an authentication bypass in the SSL-VPN that allows attackers to get around multi-factor authentication (MFA). According to the report, this flaw is already being exploited in attacks.

An SSL-VPN is usually reachable from the internet and gives access to the internal network behind the firewall. A working MFA bypass therefore removes one of the most important protections for remote access to your servers and internal systems.

The source data does not list the individual flaws or the fixed firmware versions. Check the SonicWall advisory and the report linked below for the exact versions that contain the fixes.

Who is affected

Administrators of SonicWall firewalls running SonicOS, in particular where the SSL-VPN is enabled and reachable from the internet. If you manage SonicWall devices for customers, all of these devices should be checked. Devices that have not received the update released on 6 November 2026 should be considered at risk.

What to do now

1. Make a list of all SonicWall firewalls you operate and note their current SonicOS version and whether SSL-VPN is enabled.
2. Open the SonicWall advisory and identify the fixed SonicOS version for each model.
3. Export a backup of the current configuration (settings export) from each device before updating.
4. Install the fixed SonicOS firmware and reboot the device. Plan a short maintenance window, as the reboot interrupts network traffic and VPN connections.
5. After the reboot, confirm that the new version is running, that VPN connections work and that MFA is enforced for SSL-VPN logins.
6. If you cannot update right away, reduce exposure: restrict SSL-VPN access to known IP addresses where possible, or temporarily disable SSL-VPN until the update is installed.
7. Because the flaw is already exploited, reset the passwords of SSL-VPN users if you find any suspicious activity, and end all active VPN sessions after updating.

How to check whether you are affected

• Compare the SonicOS version shown in the device dashboard with the fixed versions in the SonicWall advisory.
• Review the SSL-VPN and authentication logs for logins from unknown IP addresses or countries, logins at unusual times, and successful logins without a matching MFA step.
• Check the list of local users and SSL-VPN users for accounts you did not create, and review recent configuration changes.
• Look at the internal servers reachable through the VPN for unusual logins or access originating from VPN address ranges.
• If you find signs of unauthorised access, treat it as a security incident: isolate affected systems, change all credentials that were used over the VPN and investigate further before returning to normal operation.

Sources

• https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-new-ssl-vpn-mfa-bypass-flaw-exploited-in-attacks/