SonicWall has shipped security updates fixing seven vulnerabilities in its SonicOS firewall software — and one of them is already being weaponized.

The headline flaw is an SSL-VPN authentication bypass that undermines multi-factor authentication, which BleepingComputer reports is being exploited in active attacks. An MFA bypass on a VPN endpoint is about as bad as it gets for perimeter security: it hands attackers a path past the control that organizations deploy specifically to stop credential-based intrusions.

SonicWall gear has been a recurring target for ransomware crews and initial-access brokers, and edge devices in general remain one of the most attacked categories of enterprise infrastructure — they face the internet by design and often lag on patching.

The playbook for admins is unchanged but urgent: inventory exposed SonicOS devices, apply the updates, and review authentication logs for signs of bypass activity predating the patch. With exploitation already confirmed, this is a patch-now situation rather than a next-maintenance-window one.