CTIPilot
AI-generated · no human review · verify critical claims against the linked source. how it works →

SonicWall SMA 100

product · product:sonicwall-sma-100

Coverage
1
first 2026-05-21 → last 2026-10-21
Latest activity
2026-05-21
Patched SonicWall Gen6 SSL-VPNs still let brute-forced accounts skip MFA unless the LDAP fix is redone by hand
Peak priority
notable
1 notable
Targets
·
no sector or region stated
Sources cited
4
4 hosts

Defender insights

What each entry about SonicWall SMA 100 tells a defender to do, newest first.

2026-05-21NOTABLEexploitedPatched SonicWall Gen6 SSL-VPNs still let brute-forced accounts skip MFA unless the LDAP fix is redone by hand

Exposure · triage · detection

Story timeline

  1. 2026-05-21SonicWall Gen6 SSL-VPN: patched-firmware appliances still open to the CVE-2024-12802 MFA bypass without manual LDAP remediation, exploited February to March 2026 by a suspected access broker
    active-threatsPatched SonicWall Gen6 SSL-VPNs still let brute-forced accounts skip MFA unless the LDAP fix is redone by hand

Hunting pivots

CVEs (exploited first)
CVE-2024-12802
Releases covered
SonicWall SMA 100
Tags
actively-exploitedauth-bypassidentityvulnerabilities
ATT&CK techniques (6 across 7 tactics)

6 techniques observed across 1 entry about this entity, derived from entry metadata and body evidence, never asserted without a published entry behind it · pinned to MITRE ATT&CK v20.0 · compare on the matrix · Navigator layer (JSON)

  • Initial AccessValid Accounts · External Remote Services
  • PersistenceValid Accounts · External Remote Services · Modify Authentication Process: Multi-Factor Authentication
  • Privilege EscalationValid Accounts
  • StealthValid Accounts
  • Defense ImpairmentModify Authentication Process: Multi-Factor Authentication · Disable or Modify Tools
  • Credential AccessBrute Force · Modify Authentication Process: Multi-Factor Authentication
  • Lateral MovementRemote Services: Remote Desktop Protocol

Initial Access TA0001

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Persistence TA0003

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

T1133External Remote Services×1

Adversaries may leverage external-facing remote services to initially access and/or persist within a network. Remote services such as VPNs, Citrix, and other access mechanisms allow users to connect to internal enterprise network resources from external locations. There are often remote service gateways that manage connections and credential authentication for these services. Services such as Windows Remote Management and VNC can also be used externally.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Privilege Escalation TA0004

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Stealth TA0005

T1078Valid Accounts×1

Adversaries may obtain and abuse credentials of existing accounts as a means of gaining Initial Access, Persistence, Privilege Escalation, or Defense Evasion. Compromised credentials may be used to bypass access controls placed on various resources on systems within the network and may even be used for persistent access to remote systems and externally available services, such as VPNs, Outlook Web Access, network devices, and remote desktop. Compromised credentials may also grant an adversary increased privilege to specific systems or access to restricted areas of the network. Adversaries may choose not to use malware or tools in conjunction with the legitimate access those credentials provide to make it harder to detect their presence.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Defense Impairment TA0112

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

T1685Disable or Modify Tools×1

Adversaries may disable, degrade, or tamper with security tools or applications (e.g., endpoint detection and response (EDR) tools, intrusion detection systems (IDS), antivirus, logging agents, sensors, etc.) to impair or reduce visibility of defensive capabilities. This may include stopping specific services, killing processes, modifying or deleting tool configuration files and Registry keys, or preventing tools from updating. This may also include impairing defenses more broadly by disrupting preventative, detection, and response mechanisms across host, network, and cloud environments.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Credential Access TA0006

T1110Brute Force×1

Adversaries may use brute force techniques to gain access to accounts when passwords are unknown or when password hashes are obtained. Without knowledge of the password for an account or set of accounts, an adversary may systematically guess the password using a repetitive or iterative mechanism. Brute forcing passwords can take place via interaction with a service that will check the validity of those credentials or offline against previously acquired credential data, such as password hashes.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

T1556.006Modify Authentication Process: Multi-Factor Authentication×1

Adversaries may disable or modify multi-factor authentication (MFA) mechanisms to enable persistent access to compromised accounts.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Lateral Movement TA0008

T1021.001Remote Services: Remote Desktop Protocol×1

Adversaries may use Valid Accounts to log into a computer using the Remote Desktop Protocol (RDP). The adversary may then perform actions as the logged-on user.

Evidence: 2026-05-21/sonicwall-gen6-ssl-vpn-incomplete-patching-cve-2024-12802-ak · ATT&CK page ↗

Entries about SonicWall SMA 100 (1)

2026-05-21 · view entry permalink →

NOTABLECVE-2024-12802exploitedupdatedNATOB2

SonicWall Gen6 SSL-VPN: patched-firmware appliances still open to the CVE-2024-12802 MFA bypass without manual LDAP remediation, exploited February to March 2026 by a suspected access broker

SonicWall's SNWLID-2025-0001 describes CVE-2024-12802 (CWE-305, CVSS 6.5): when SSL-VPN authenticates against Microsoft Active Directory, UPN and SAM account names are handled separately, so MFA can be configured independently for each and an attacker can bypass it through the alternative account name (SonicWall SNWLID-2025-0001); in practice an attacker with valid credentials authenticates without the MFA step (BleepingComputer, 2026-05-20). On Gen6 the fixed firmware does not remove the vulnerable LDAP configuration, so six manual steps are needed: delete the LDAP configuration that uses userPrincipalName, remove cached LDAP users, remove the SSL VPN user domain, reboot, recreate the LDAP configuration without userPrincipalName and take a fresh backup (BleepingComputer, 2026-05-20); Gen7 firmware version 7.2.0-7015 and Gen8 firmware version 8.0.1-8017 build those steps in (SonicWall SNWLID-2025-0001). ReliaQuest responded to intrusions between February and March 2026 on Gen6 devices that looked patched and assesses with medium confidence that they are the first in-the-wild exploitation; the attacker brute-forced VPN accounts with an automated tool, in one case after only 13 attempts, and reached a file server within 30 minutes (ReliaQuest, 2026-05-19), connected to it over RDP with a shared local administrator password, and tried to deploy a Cobalt Strike beacon and a vulnerable driver to disable endpoint protection, both blocked by EDR (BleepingComputer, 2026-05-20). ReliaQuest describes the tools as consistent with actors in the ransomware ecosystem and the logouts and later re-entries with other accounts as initial access broker activity (ReliaQuest, 2026-05-19); the researchers could not attribute the attacks, though the activity resembled the Akira ransomware group's (Cybersecurity Dive, 2026-05-19).

Triage: where no CLI-based VPN client is authorized or typical, any sess="CLI" event is a high-fidelity indicator; where scripted VPN authentication is legitimate, ReliaQuest says to baseline it and tune on volume, source IP and timing (ReliaQuest, 2026-05-19).

SSL-VPN MFA Bypass in SonicWALL SSL-VPN can arise in specific cases due to the separate handling of UPN (User Principal Name) and SAM (Security Account Manager) account names when integrated with Microsoft Active Directory

SonicWall SNWLID-2025-0001 2025-01-07

The sess="CLI" session type indicates scripted or automated VPN authentication.

The voluntary logouts, combined with re-entry attempts days later using different accounts in some environments, are consistent with initial access broker (IAB) activity.

ReliaQuest 2026-05-19

Researchers could not provide direct attribution for the attacks, but the threat activity was consistent with ransomware activity from the Akira group.

Cybersecurity Dive 2026-05-19
Correctionrun 2026-10-21T1148Z-auditaffected_productsbodyclassificationcvesentitiesevent_dateevidenceheadlineregionssectorssourcessourcing_notesummarytagstechniquestitle

SonicWall scores CVE-2024-12802 CVSS 6.5 with a vector that requires a low-privileged account (PR:L), not 9.1 for an unauthenticated attacker; 9.1 is the assessment of CISA's Authorized Data Publisher (SonicWall SNWLID-2025-0001) (ReliaQuest, 2026-05-19), and the attacker needs valid credentials, which here were brute-forced. The attacks are not attributed: ReliaQuest describes a likely initial access broker using tools of the ransomware ecosystem, and the researchers could not attribute them, only compare them with Akira's 2025 activity (ReliaQuest, 2026-05-19) (Cybersecurity Dive, 2026-05-19).

The six remediation steps come from SonicWall's advisory as BleepingComputer lists them (BleepingComputer, 2026-05-20). The detection signal ReliaQuest found is the sess="CLI" session type with Event IDs 238 and 1080 and a CLI-to-GMS transition, not UPN-format login names (ReliaQuest, 2026-05-19).

threat21 May 05:00Zmulti-sourceOpen finding →
Sources: ReliaQuest · SonicWall SNWLID-2025-0001 · Cybersecurity Dive · BleepingComputer

Co-occurring entities

Derived: referenced by the same focused operational entries (weekly summaries and report roundups don't count); ×N counts the shared entries.

Where this entity is cited

  • Threats1

Source distribution

  • bleepingcomputer.com1 (25%)
  • cybersecuritydive.com1 (25%)
  • psirt.global.sonicwall.com1 (25%)
  • reliaquest.com1 (25%)
All cited sources (4)