This vulnerability in SonicWall SonicOS SSL-VPN involves an authentication bypass due to inconsistent MFA enforcement between UPN and SAM account name login methods when integrated with Microsoft Active Directory. Because MFA can be configured separately for these two login identifiers, an attacker may bypass MFA by authenticating with the alternative account name that does not have MFA enforced. The flaw affects multiple SonicOS versions including 6.5.x, 7.x, and 8.0.0-8035. The CVSS 3.1 score of 9.1 reflects critical impact with network attack vector and no required privileges or user interaction. The vendor has not yet provided an official fix or remediation guidance, and no known exploits have been reported.

Successful exploitation allows an attacker to bypass multi-factor authentication on SonicWall SSL-VPN devices integrated with Microsoft Active Directory, potentially leading to unauthorized access with full confidentiality and integrity impact. This could compromise sensitive data and system integrity without requiring user interaction or privileges. The vulnerability does not impact availability. No known exploits are currently reported in the wild.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is released, organizations should review their MFA configurations for SonicWall SSL-VPN, specifically ensuring consistent MFA enforcement across all login methods (UPN and SAM). Consider additional compensating controls such as network segmentation or restricting VPN access to trusted IPs. Monitor vendor channels for updates and apply patches promptly once available.