SonicWall Gen6 SSL-VPN MFA Bypass Incomplete Patching | MSSP Advisory

Threat actors are brute-forcing VPN credentials and bypassing multi-factor authentication on SonicWall Gen6 SSL-VPN appliances, even on devices that appear to be patched. The attackers exploit incomplete patching to deploy ransomware tools after gaining initial access through compromised VPN endpoints.

Your clients running SonicWall Gen6 SSL-VPN are exposed to credential brute-force attacks that bypass MFA protection, creating a direct path for ransomware deployment. Many clients believe their SonicWall devices are secure after patching, but incomplete remediation leaves them vulnerable to this specific attack chain.

📬