SonicWall SonicOS SSL-VPN auth bypass under active exploitation

Affected Systems

SonicWall SonicOS firewalls with SSL-VPN enabled. Seven vulnerabilities patched; specific affected versions not disclosed in provided data. Authentication bypass flaw is actively exploited.

Exploitation Status

Active exploitation confirmed for SSL-VPN authentication bypass vulnerability. Exploitation status unknown for remaining six vulnerabilities.

Business Impact

Organizations using SonicWall SonicOS firewalls with SSL-VPN face immediate risk of unauthorized network access. Attackers can bypass authentication to gain VPN access, potentially leading to lateral movement, data exfiltration, and persistent access to internal networks. CVE identifiers and CVSS scores not provided in source material.

Urgency

🔴 Immediate

Recommended Actions

• Apply SonicWall security updates for SonicOS immediately on all firewalls, prioritizing internet-facing devices with SSL-VPN enabled
• Review SonicOS firewall logs for anomalous SSL-VPN authentication patterns, failed login attempts followed by successful access, or connections from unexpected geolocations
• Temporarily disable SSL-VPN on SonicOS devices if patching cannot be completed within 24 hours and alternative remote access exists
• Audit all active SSL-VPN sessions and terminate suspicious connections; force re-authentication of all users post-patch
• Monitor SonicWall security advisories for CVE assignments, IOCs, and additional technical details as they become available