AI analysis
Claude Opus · 7 Nov 2026, 10:19 CET
SonicWall SonicOS SSLVPN flaw lets alternate logins bypass SAML and MFA, exploited
Attackers with valid credentials for another login method can bypass SAML and SAML-enforced MFA on SonicOS SSLVPN. CISA confirms active exploitation. Apply SonicWall's mitigations now; federal deadline is 2026-11-20.
In plain terms
SonicWall firewalls running SonicOS include an SSLVPN service that lets remote employees connect to the company network. Many organisations put that service behind SAML, a single sign-on standard that sends users to a central identity provider, often with multi-factor authentication (MFA), meaning a second step such as a phone prompt in addition to a password. This flaw means the SSLVPN may not consistently enforce SAML. Someone who has working credentials for a different, alternate login method could get in without going through the SAML and MFA checks.
In practice, a stolen or guessed password may be enough to reach the VPN, even where the organisation believed MFA was mandatory. CISA has confirmed that this is being exploited. Any organisation that relies on SonicWall SSLVPN with SAML or SAML-based MFA for remote access should treat this as urgent.