ACT NOWExploited vulnerability
SonicWall SonicOS SSLVPN
SonicWall SonicOS SSLVPN Use of Single-factor Authentication Vulnerability
What's happening and what to do
An attacker with valid credentials for an alternate login method can bypass SAML sign-in controls and even skip SAML-enforced multi-factor authentication, and this flaw is being actively exploited. SonicWall SonicOS SSLVPN. Apply the vendor's update now and check for signs of compromise, such as unexpected VPN logins.
AI summary of the sources on this page. Regenerated when a source changes.
Signals over time
- 2026-11-06Added to CISA's Known Exploited Vulnerabilities catalog.
- 2026-11-06 20:10First seen here.
- 2026-11-20Federal patch deadline for US agencies.
Source text
SonicWall SonicOS SSLVPN contains a use of single-factor authentication vulnerability that may allow a user with valid credentials for an alternate authentication method to bypass SAML authentication controls. Successful exploitation may also bypass SAML-enforced multi-factor authentication (MFA).