SonicWall released patches for a critical MFA bypass in SSLVPN in October 2026. The fix is necessary, but it is not sufficient. The vulnerability stems from how SonicWall SSLVPN resolves Active Directory identities during authentication, and simply applying the security update leaves organizations exposed unless they also change how their LDAP integration is configured. This gap is already being exploited in the wild.
The vulnerability
The flaw exploits a difference between two Active Directory identifier formats: User Principal Name (UPN, format [email protected]) and Security Account Manager name (SAM, format DOMAIN\user). SonicWall SSLVPN can be configured to authenticate users against AD using either format. When MFA is enforced on the UPN path but not consistently mapped to the SAM path, an attacker can submit credentials in SAM format to bypass the MFA check entirely. No second factor is requested.
Why patching alone fails
The patch addresses the specific code path that allows format confusion to bypass MFA. However, if the underlying LDAP configuration still exposes both UPN and SAM authentication paths without consistent MFA enforcement, the attack surface persists through misconfiguration rather than vulnerable code. Organizations that apply the patch without reviewing their LDAP bind configuration and authentication policy mapping remain vulnerable to variants of this technique. SonicWall's advisory acknowledges this and provides specific reconfiguration steps, but the steps are buried in an appendix that many administrators skip.
Active exploitation context
ReliaQuest and multiple threat intelligence teams observed active exploitation of this class of vulnerability against SonicWall SSLVPN deployments in October and early November 2026. Attackers authenticated through the bypass and established persistent access using legitimate VPN credentials, making detection harder than typical brute-force attacks. Network telemetry showed sustained authenticated sessions originating from residential proxy infrastructure, a hallmark of initial access broker activity.
What you need to do now
- Apply the SonicWall patch immediately: the update is a prerequisite, not a complete fix. Without it, the attack is trivially repeatable by any attacker with valid credentials.
- Review your LDAP integration: follow SonicWall's advisory appendix to verify that MFA enforcement applies consistently regardless of which AD identifier format is used. Test by attempting authentication in both UPN and SAM formats from a controlled account.
- Audit recent SSLVPN authentication logs: look for successful MFA-exempt sessions or authentication events using SAM-format identifiers where your policy should require MFA. Cross-reference with known residential proxy IP ranges.
The quiet lesson
Security controls that apply inconsistently across authentication paths are not security controls. When you configure MFA for a service, verify explicitly that enforcement holds for every code path an attacker might take, including format variations and fallback mechanisms. A patch release tells you a problem existed. The advisory tells you whether applying the patch is enough.
Gigia Tsiklauri is a Security Architect and founder of Infosec.ge. Get in touch if your team needs help reviewing VPN authentication configurations or hunting for signs of initial access broker activity.