No Window to Patch: SonicWall MFA Bypass and Zyxel Switch Zero-Day

Key Takeaways

SonicWall published advisory SNWLID-2026-0014 on November 6, 2026, covering seven SonicOS vulnerabilities. One of them, CVE-2026-19868 (CVSS 7.1), lets an attacker who holds valid credentials for a non-SAML authentication method get past SAML controls on SSL-VPN services, which can include SAML-enforced multi-factor authentication (MFA) [1][2][3]. CISA added the flaw to its Known Exploited Vulnerabilities (KEV) catalog the same day and set a federal remediation deadline of November 20, 2026 [3][4]. SonicWall itself says only that it is investigating a report of potential exploitation, and it has published no indicators of compromise [2][3]. Fixed releases are SonicOS 7.3.4-7013 (Gen7) and 8.2.3-8015 (Gen8), and SonicWall says no workaround exists [2][3].

Zyxel disclosed CVE-2026-107441 on November 3, 2026. The flaw is an out-of-bounds write in the web management CGI of ten GS1900 switch models that allows unauthenticated OS command execution [5][6]. GreyNoise reported in September that a campaign beginning around August 17 had compromised 996 switches in 48 countries, more than half of which still used factory-default credentials [9][11]. Binarly later showed that an exploit tied to that campaign still worked on firmware patched for the earlier CVE-2026-7273, so switches that appeared patched remained exploitable until Zyxel shipped a further fix in late October [6][7][10]. Zyxel’s advisory does not confirm exploitation, and the flaw had not been added to CISA’s KEV catalog as of November 4; the zero-day characterization rests on Binarly’s analysis [4][6][7]. Binarly also believes the attacker’s exploit was LLM-generated [8].

Neither incident gave defenders a usable window between disclosure and exploitation. The SonicWall flaw was listed as exploited on the day the advisory came out [3][4]. By Binarly’s account, the Zyxel flaw was exploited from about August 17, roughly eight weeks before CVE-2026-107441 was assigned on October 11 and eleven weeks before Zyxel’s November 3 advisory [6][7]. Both incidents also show that a patch is not proof of remediation. Zyxel’s June fix missed the path attackers were using [6], and an earlier SonicWall MFA bypass stayed open on patched Gen6 devices until administrators also reconfigured LDAP [13][14].

Organizations should patch both product lines now, review VPN authentication logs for non-SAML logins on gateways where SAML is enforced, and treat any GS1900 switch that ran 2.90 Patch 2 or earlier with a management interface reachable from untrusted networks as possibly compromised. Over the longer term, edge-device patching should be triggered by disclosure itself rather than by a later “known exploited” flag, and it should be paired with verification that the fix actually closes the exploitable path.

Background

Edge and network infrastructure devices remain a favored entry point for attackers, and espionage groups in particular [15]. Mandiant’s M-Trends 2026 found that exploits were the most common initial infection vector for the sixth year running, at 32% of intrusions. It also estimated mean time to exploit at negative seven days, and Mandiant describes exploitation as routinely occurring before a patch is released [15]. Because a negative mean can be pulled down by a minority of very early cases, the more cautious reading is that a substantial share of exploitation begins before a patch is available. The same report notes that espionage groups target VPNs, routers, and other edge devices because these devices usually lack endpoint detection and response telemetry and offer little storage for forensic work [15]. VulnCheck’s first-half 2026 analysis complements this picture: 23.43% of newly catalogued known-exploited vulnerabilities showed exploitation on or before the day their CVE was published, and across the 495 KEVs it identified, most edge-device manufacturers, SonicWall among them, had new entries [16].

AI has made this pressure harder to measure. VulnCheck counted 1,061 vulnerabilities attributed to AI-assisted discovery and found that only 14 of them (1.3%) had confirmed in-the-wild exploitation by mid-2026 [16]. That figure argues against claims that AI-found bugs are already flooding attacker toolkits. The Zyxel case points to a different effect. Here AI appears to have been used to build and adapt an exploit for a known bug class in a product line that attackers were already targeting, not to discover a new vulnerability [8]. AI’s main effect on edge-device risk may therefore be faster weaponization and variant development rather than a larger number of discoveries. With current evidence, that remains an inference rather than an established trend.

SonicWall products have been exploited repeatedly in 2026. Its Secure Mobile Access (SMA) 1000 remote-access appliances had chained zero-days exploited in July and again in September [2][18]. CSA reported that exploitation attempts against a third maximum-severity SMA 1000 SSRF, CVE-2026-102255, began about two days after the October 6 patch, even though the vendor advisory did not mark it as exploited [17]. Earlier in the year, ReliaQuest attributed intrusions in February and March 2026 to CVE-2024-12802, an MFA bypass in Gen6 SSL-VPN appliances. Attackers brute-forced VPN credentials and logged in without MFA, and their sessions looked like normal MFA flows in the logs [13][14]. CVE-2026-19868 is therefore at least the second SonicWall SSL-VPN MFA-enforcement weakness seen exploited in 2026, and unlike its predecessor it affects the current Gen7 and Gen8 firewall lines [2][14].

Security Analysis

The two November disclosures differ in mechanism but share a lesson. The SonicWall flaw is a logic weakness in how authentication methods are enforced, while the Zyxel flaw is a memory-safety bug whose first fix proved incomplete. The subsections below examine each in turn, consider the role AI played in the Zyxel case, and then place both incidents alongside comparable edge-device exploitation CSA has tracked earlier in 2026.

CVE-2026-19868: When MFA Depends on Which Door Is Used

SonicWall describes CVE-2026-19868 as an authentication enforcement weakness in the SonicOS SSL-VPN service. The flaw only matters on gateways set up for SAML authentication. On those gateways, a user with valid credentials for a different authentication method can bypass SAML controls, and that bypass can extend to MFA enforced through the SAML identity provider [1][2][3]. This is not an unauthenticated bypass. The attacker needs working credentials, and the most likely candidates are local, LDAP, RADIUS, or legacy service accounts that still exist alongside the SAML integration. Ryan Harris of The Electronic Office reported the flaw. SonicWall says it is investigating a report of potential exploitation but has not published indicators of compromise, attack details, or attribution [2][3].

The moderate CVSS score understates the operational risk. Many organizations moved SSL-VPN authentication to SAML so that conditional access and phishing-resistant MFA would be enforced centrally by an identity provider. A flaw that lets a non-SAML credential skip that path undoes the control without producing an obvious failure in gateway logs. Credential-stuffing and brute-force campaigns against SonicWall VPNs are well documented, including the CVE-2024-12802 intrusions [13][14]. That makes it plausible that attackers already hold valid passwords for some local or directory accounts on exposed gateways, and in those environments the credential requirement may offer little practical protection. The ReliaQuest findings on CVE-2024-12802 also suggest that log review is hard: rogue logins in that campaign looked like successful MFA flows, so defenders believed MFA had worked [14].

The same advisory fixes six other flaws that are not reported as exploited. Two are rated 8.8 in the SonicOS management interface, a permissive cross-domain policy issue and a session validation bug, either of which a remote attacker may be able to exploit without logging in under certain conditions. The others are pre-authentication buffer overflows in the SSL-VPN service and TACACS+ client that can cause denial of service, and a weak password hashing issue in virtual appliances [3]. Exposed management interfaces should therefore be treated as a second urgent reason to apply this update.

CVE-2026-107441: The Patch That Did Not Close the Door

The Zyxel case is harder to follow, and its timeline is the core lesson. Zyxel patched CVE-2026-7273, a pre-authentication buffer overflow in GS1900 firmware, on June 16, 2026 [6]. GreyNoise saw exploitation begin around August 17 and reported on September 21 that 996 switches across 48 countries had been compromised, and CISA added CVE-2026-7273 to KEV the same day [4][6][11]. Attackers took device configuration files, hashed root credentials, and network information [6][11]. GreyNoise also found that 564 of the 996 compromised switches still used factory-default credentials [9]. Because a majority of compromised switches retained default credentials, the share of the 996 compromises attributable to the patch-bypass exploit, rather than to credential abuse or to the original CVE-2026-7273 on unpatched devices, is not established.

The link between the campaign and the new flaw comes from Binarly’s analysis of attacker infrastructure. Acronis had tied the JITTERLY backdoor and its embedded SIXZUT rootkit to a Chinese-speaking cluster it tracks as Red Heron [12]. GreyNoise, which tracks the Zyxel activity as Kapibala, assesses the two as the same or related on the basis of a shared command-and-control domain, a shared malware family, and overlapping tactics [11]. Analyzing infrastructure tied to this cluster, Binarly found a packaged exploit on an exposed server containing a PyArmor-obfuscated Python script that targets /cgi-bin/dispatcher.cgi [10]. The script checked for firmware versions that had already been patched against CVE-2026-7273, and Binarly confirmed that it achieved unauthenticated command execution, without modification, on all ten firmware releases that included the June fix [6][10]. On that basis, Binarly concluded that the attackers had exploited CVE-2026-107441 rather than CVE-2026-7273 [7].

The technical failure was narrow but consequential. Zyxel’s June patch had added overflow checks, but the exploit got around them by corrupting a parameter counter before it was validated and by abusing missing checks on HTTP parameter length [9]. Zyxel treated the missing length check as a separate flaw and assigned CVE-2026-107441 on October 11. It released Patch 3 firmware around October 22–23 and published its advisory on November 3 [5][6][8][9]. The advisory does not say the flaw has been exploited, and as of November 4 CVE-2026-107441 had not been added to the KEV catalog [4].

Sources also disagree on severity. Zyxel rates the flaw 8.8 and describes the attacker as LAN-based, while Binarly rates it 9.8 [5][7][9]. In practice, the campaign shows that many GS1900 management interfaces were reachable from the internet or other untrusted networks, which makes Zyxel’s LAN-based characterization less reassuring than the lower score suggests. Binarly’s broader conclusion is that advisories and version numbers cannot be blindly trusted, and that the shipped binary code is what should be checked [7][10]. From August until Patch 3 shipped in late October, an organization that applied Zyxel’s June firmware as directed by the vendor and CISA’s KEV entry would still have had exploitable switches unless management interfaces were otherwise isolated.

The AI Dimension

Binarly reported two uses of large language models in this case. It believes the attacker’s GS1900 exploit was LLM-generated, and its own researchers used LLMs to build emulated environments for the affected firmware so they could test the exploit across all ten releases [8][10]. Binarly’s public statement is an assessment, and the evidence behind the attribution has not been published in detail, so this note treats it as plausible rather than confirmed. Even so, the case fits the industrialized exploit workflow that the time-to-exploit data describe. A known bug class, a vendor patch that can be diffed, and a widely deployed, low-visibility device family are exactly the inputs that LLM-assisted development is likely to speed up.

The defensive use is just as relevant. Building firmware emulation for embedded devices has long been slow, specialized work. If LLMs shorten it, defenders and vendors can check whether a patch actually closes an exploitable path before attackers find out that it does not. The Zyxel timeline shows why that step matters: the June fix addressed the reported overflow but left the parameter-counter and length-check paths open, and attackers adapted their exploit to those paths within weeks. Variant analysis of the patch, not only reproduction of the original proof-of-concept, might have found the remaining path before attackers did.

Comparative View

Placing the two November disclosures beside earlier incidents helps separate what is specific to each vendor from what recurs across edge devices. The table below sets them against the two CSA-tracked edge incidents from earlier in 2026 that are most comparable in device role and flaw class. This is a small, deliberately chosen set rather than a statistical sample, so it illustrates rather than proves the broader trend.

In the three cases where timing is documented, the window between disclosure and exploitation was absent or a matter of days. In two of the four, the vendor’s initial signal (an advisory not marked exploited, or a patch that did not work) understated the real risk. The Zyxel case adds a distinct lesson: no patching policy would have helped there until Patch 3 shipped, which points to patch verification as a separate gap from patch timing. These observations are consistent with the broader Mandiant and VulnCheck data [15][16], and they suggest that patch policies which wait for confirmed exploitation or a KEV listing leave organizations exposed during exactly the period that matters most.

Recommendations

The recommendations below move from immediate remediation of the two disclosed flaws, to near-term changes in how edge devices are exposed and patched, to longer-term program design. Each tier builds on the previous one: patching closes the known holes, exposure reduction limits the damage from the next one, and strategic changes address why these gaps keep recurring.

Immediate Actions

Organizations running SonicWall Gen7 or Gen8 firewalls should upgrade to SonicOS 7.3.4-7013 or 8.2.3-8015 now, giving first priority to any gateway where SSL-VPN uses SAML [2][3]. Until the upgrade is done, administrators should list every authentication method still enabled on SAML-enforced gateways. Local, LDAP, and RADIUS accounts that do not need SSL-VPN access should lose it, and remaining credentials should be rotated. Authentication logs from the exposure window should be checked for SSL-VPN logins that did not go through the SAML identity provider. Because SonicWall has published no indicators of compromise, this check depends on comparing gateway logins with identity-provider sign-in records [3].

Organizations running Zyxel GS1900 switches should install the model-specific 2.90 Patch 3 firmware listed in Zyxel’s advisory (for example, 2.90(AAHH.3)C0 for the GS1900-8) [5]. Any switch that ran Patch 2 or earlier with a management interface reachable from untrusted networks should be investigated as possibly compromised. Because configuration files and hashed root credentials were taken in the campaign, remediation should include resetting all device credentials, rotating any secrets stored in switch configurations (SNMP communities, RADIUS or TACACS+ keys), and removing factory-default passwords [6][9][11].

Short-Term Mitigations

Management interfaces on switches, firewalls, and VPN appliances should only be reachable from a dedicated management network or jump host, never from user VLANs or the internet. Both the Zyxel exploit and the SonicOS management-interface flaws depend on that kind of reachability [3][5]. Logs from edge and network devices should be forwarded to a SIEM and kept longer than typical short retention periods, which are often 90 days or less. Mandiant notes that espionage dwell times on network appliances can exceed the period most organizations retain logs for [15].

Organizations should also change what triggers emergency edge-device patching. In the incidents analyzed here, waiting for a “known exploited” flag would have meant waiting past the start of attacks. Any pre-authentication or authentication-bypass flaw in an internet-facing edge device should be handled on an emergency timeline when it is disclosed [17]. Where a vendor fix follows an earlier failed fix, as with Zyxel, teams should check the running firmware against the specific fixed build rather than relying on a version range, and should be ready to apply the fix again.

Strategic Considerations

Taken together with the Mandiant and VulnCheck data, these incidents suggest a structural problem: edge devices combine fast exploitation, sustained attacker interest, and limited defender visibility [15][16]. Organizations should consider building their edge-device programs around three ideas. The first is to assume compromise is possible at disclosure and to design detection on that basis. The second is to reduce the number of authentication paths into the VPN, so that a SAML or MFA policy cannot be bypassed through a legacy method left beside it. The third is to ask vendors for evidence that a patch works, such as regression testing against public exploit techniques, rather than only for a version number.

These principles carry into procurement as well. Vendor assessments should consider how often a product line produces repeat critical flaws, how quickly the vendor publishes exploitation status, and whether its fixes have needed follow-up corrections. On the AI side, defenders should plan for the possibility, suggested but not yet confirmed by the Zyxel case, that attackers will produce exploit variants for patched bugs more quickly. They should invest in the same capabilities, including LLM-assisted firmware emulation, patch diffing, and variant analysis, to test their own exposure before attackers do.

CSA Resource Alignment

This note builds directly on several earlier CSA analyses of edge-device exploitation. SonicWall SMA Zero-Days: Edge Appliance Root Returns [18] examined the chained SMA 1000 zero-days exploited in July 2026, which gave unauthenticated attackers root-level compromise of the appliance. SonicWall SMA 1000: Exploitation Attempts Within Two Days of Patch [17] is the closest precedent for the present analysis. It documented attempts against CVE-2026-102255 about two days after the fix shipped, at a time when the vendor advisory did not flag exploitation, and it warned that organizations which gate emergency patching on a “known exploited” signal would have waited past the first attacks. The SonicOS and Zyxel incidents extend that finding beyond one product family, consistent with an edge-device pattern. CVE-2026-19868 was listed as exploited on the day of its advisory, and, by Binarly’s analysis, CVE-2026-107441 was exploited before it had a CVE at all.

PAN-OS GlobalProtect Auth Bypass: Active NGFW Exploitation [19] analyzed CVE-2026-0257, in which forged authentication cookies gave attackers fully authorized VPN sessions. Together with CVE-2026-19868, it shows that VPN authentication logic is itself an active attack surface, separate from memory-safety bugs. The GlobalProtect note’s guidance on separating authentication functions and hardening configuration applies directly to the SAML-plus-legacy-method exposure discussed here.

The Exploitation Time Collapse [20] argues that enterprise patching cycles built around a disclosure-to-exploit window no longer work, citing the Mandiant and VulnCheck data that also underpins this note. The incidents examined here are concrete edge-device examples of that thesis, and the Zyxel case adds a dimension that paper treats only briefly: a patch that did not close the exploited path.

For control mapping, the CSA AI Controls Matrix (AICM) v1.1 [21] Threat and Vulnerability Management (TVM) domain covers remediation timelines, vulnerability prioritization, and verification of remediation effectiveness. The Identity and Access Management (IAM) domain covers authentication-method governance, which is the control gap CVE-2026-19868 exploits. Organizations aligning to AICM should consider whether their TVM controls require verifying that a fix works for edge devices, and whether their IAM controls require all remote-access authentication paths to enforce the same MFA policy.

References

[1] SonicWall PSIRT. “SonicOS SSL-VPN and Management Interface Vulnerabilities (SNWLID-2026-0014).” SonicWall, November 6, 2026.

[2] Lawrence Abrams. “SonicWall warns of new SSL-VPN MFA bypass flaw exploited in attacks.” BleepingComputer, November 6, 2026.

[3] Eduard Kovacs. “SonicWall Patches Exploited SonicOS Vulnerability That Weakens VPN Logins.” SecurityWeek, November 7, 2026.

[4] Cybersecurity and Infrastructure Security Agency. “Known Exploited Vulnerabilities Catalog.” CISA, accessed November 8, 2026.

[5] Zyxel. “Zyxel security advisory for out-of-bounds write vulnerability in GS1900 series switches.” Zyxel Community, November 3, 2026.

[6] Lawrence Abrams. “Zyxel fixes zero-day exploited to hack nearly 1,000 network switches.” BleepingComputer, November 4, 2026.

[7] Ionut Arghire. “Zyxel Switch Hacks Blamed on Patched Flaw Actually Exploited a Zero-Day.” SecurityWeek, November 5, 2026.

[8] Zeljka Zorz. “Patched Zyxel GS1900 switches remained open to in-the-wild exploit (CVE-2026-107441).” Help Net Security, November 5, 2026.

[9] Swati Khandelwal. “Zyxel GS1900 Patch Fails to Block Zero-Day Exploit Allowing Root Command Execution.” The Hacker News, November 5, 2026.

[10] Binarly. “New Zyxel GS1900 pre-auth RCE vulnerability revealed.” Binarly, November 2026.

[11] Andrew Thompson and Mark Mager. “Open Season on Kapibala: Attacker Steals Over 18,000 Government Records Through WordPress Exploitation.” GreyNoise, September 21, 2026.

[12] Subhajeet Singha. “Red Heron exploits Gitea n-day flaw in multinational campaign, exposing new Linux rootkit.” Acronis Threat Research Unit, September 13, 2026.

[13] Bill Toulas. “Hackers bypass SonicWall VPN MFA due to incomplete patching.” BleepingComputer, May 20, 2026.

[14] Alexander Capraro and Tristan Luikey. “VPN Exploitation: When Patched Doesn’t Mean Protected.” ReliaQuest, May 19, 2026.

[15] Mandiant / Google Threat Intelligence. “M-Trends 2026: Data, Insights, and Strategies From the Frontlines.” Google Cloud, March 23, 2026.

[16] Patrick Garrity. “State of Exploitation 1H-2026.” VulnCheck, July 28, 2026.

[17] Cloud Security Alliance. “SonicWall SMA 1000: Exploitation Attempts Within Two Days of Patch.” CSA Lab Space, October 2026.

[18] Cloud Security Alliance. “SonicWall SMA Zero-Days: Edge Appliance Root Returns.” CSA Lab Space, July 2026.

[19] Cloud Security Alliance. “PAN-OS GlobalProtect Auth Bypass: Active NGFW Exploitation.” CSA Lab Space, June 2026.

[20] Cloud Security Alliance AI Safety Initiative. “The Exploitation Time Collapse.” CSA Lab Space, June 4, 2026.

[21] Cloud Security Alliance. “AI Controls Matrix (AICM) v1.1.” Cloud Security Alliance, 2026.