Principal Software Engineer

SonicWall VPN Vulnerabilities: SonicWall VPN Security vs ZTNA and Secure Access Alternatives. If your SonicWall VPN is internet-facing, treat it as a high-value target and reduce its role as soon as you can. Patch it, restrict access, enforce MFA, and start moving sensitive apps toward ZTNA or another identity-first access model. Traditional VPN still has uses, but it should not be the only front door to your business. TLDR: SonicWall VPN appliances have been hit by serious vulnerabilities over the years, especially in SSL VPN and SMA products, and attackers love them because one exposed gateway can unlock broad network access. A 200-person company with 60 remote staff may think one VPN box is simple, but if that device is compromised, 30% of the workforce's access path becomes a risk multiplier. ZTNA reduces that blast radius by granting access per user, per app, and per session. For example, a contractor can reach only Jira and a test server, not the whole internal subnet. Why SonicWall VPN keeps getting attention. SonicWall firewalls and secure mobile access products are common in small and mid-sized businesses. That popularity makes them attractive to attackers. A criminal group does not need to guess what you use if your VPN portal announces itself on the open internet. The problem is not that SonicWall is uniquely weak. The problem is the VPN model. A VPN gateway sits at the edge, accepts remote logins, and often connects users to broad network zones. If that gateway has a vulnerability, weak credentials, stale firmware, or poor MFA coverage, the damage can spread fast. Known SonicWall issues have included authentication bypasses, SQL injection, buffer overflows, and flaws in SSL VPN portals or SMA appliances. Some were exploited in the wild. Some affected older firmware. Some pushed admins into rushed patch cycles over a weekend. Honestly, it feels like VPN boxes have become the smoke alarm that starts chirping at 2:00 a.m. What makes VPN vulnerabilities so risky? A VPN is often treated as a trusted bridge. Once a user connects, the internal network may assume that user belongs there. That can be dangerous. * Large access zones: Users may reach more systems than they need. * Stolen credentials: Password reuse and phishing still work far too often. * Delayed patching: Firmware updates can require downtime, testing, and change approval. * Internet exposure: Attackers can scan VPN portals all day. * Legacy clients: Old VPN clients may linger on laptops for years. Expect to waste time on small operational headaches too. A firmware update may take 20 minutes, but checking compatibility, scheduling downtime, warning users, and confirming client behavior can turn it into a three-hour job. That delay matters when a vulnerability is already being exploited. SonicWall VPN security: what good looks like. If you keep SonicWall VPN in place, tighten it hard. Do not treat it as a simple "set and forget" service. * Patch quickly: Subscribe to vendor advisories and build an emergency patch process. * Use MFA for every login: No exceptions for admins, contractors, or "temporary" accounts. * Disable unused portals and services: Reduce what attackers can hit. * Restrict source IPs where possible: Allow access only from known offices, partner ranges, or managed devices. * Segment the network: A VPN user should not land in the same zone as domain controllers. * Log aggressively: Track failed logins, odd geographies, impossible travel, and new device use. * Remove stale users: Former employees and old vendor accounts are low-effort attack paths. These steps help, but they do not change the core shape of VPN access. The user still enters through a central doorway. If that doorway breaks, you have a bad day. ZTNA vs VPN: The security difference. Zero Trust Network Access, or ZTNA, flips the model. Instead of connecting a user to a network, it connects a verified user to a specific application. Access is based on identity, device health, location, role, risk score, and policy. With a VPN, Jane from finance might connect and see file shares, internal web apps, and database segments if routing permits it. With ZTNA, Jane gets access to the payroll app only after MFA, device checks, and policy approval. If her laptop lacks disk encryption or has an outdated agent, access can be blocked or reduced. The biggest gain is smaller blast radius. A stolen password should not equal broad internal access. A vulnerable gateway should not expose half the company. ZTNA also hides private apps from public scanning because many services are not directly exposed to the internet. Where SonicWall VPN still makes sense. VPN is not dead. It still works for site-to-site links, admin access to isolated environments, and legacy systems that cannot support modern access brokers. Some teams also need full tunnel routing for specific compliance or traffic inspection needs. The key is to narrow the use case. Keep VPN for what truly requires network-level access. Move common business apps, contractor access, developer portals, and SaaS-adjacent workflows to more controlled methods. Secure access alternatives to consider. Most organizations do not replace VPN with a single tool. They build a cleaner access stack. * ZTNA platforms: Best for private app access without broad network exposure. * SASE or SSE services: Combine secure web gateway, cloud access security, data controls, and private app access. * Identity-aware proxies: Good for browser-based internal apps. * Privileged access management: Better for admin sessions, server access, and audit trails. * VDI or browser isolation: Useful for contractors, unmanaged devices, and sensitive workflows. A practical plan might look like this: keep SonicWall VPN for 10 network admins, move 120 employees to ZTNA for internal apps, and require privileged session recording for server access. That mix is often safer than trying to make one VPN appliance handle every remote access need. Migration without chaos. Start with visibility. List every user group, app, subnet, and vendor that touches the VPN. Then decide what each group actually needs. You may find that many users connect to VPN only to reach one intranet page or one file share. * Map current VPN usage: Review logs for 30 to 60 days. * Pick low-risk apps first: Move simple web apps to ZTNA before complex admin tools. * Enforce device posture: Require encryption, patches, endpoint protection, and screen lock. * Run VPN and ZTNA side by side: Avoid a big bang switch. * Reduce VPN permissions: As apps move, shrink VPN routes and access groups. * Set a retirement target: Do not let the old setup live forever. What to watch during a SonicWall incident. If a SonicWall advisory drops, move fast. Check the affected product, firmware version, exposure, and logs. Look for new admin accounts, odd login times, strange source countries, changed VPN bookmarks, and new scheduled tasks on systems reached through VPN. Also rotate credentials if compromise is possible. VPN credentials are often reused across other systems. If you use Active Directory, review privileged groups and recent authentication events. A patched appliance is good, but it does not remove an attacker who already got inside. The bottom line. SonicWall VPN can be secured, but it should not carry your whole remote access strategy. Keep it patched, locked down, monitored, and limited. Then shift routine access to ZTNA or secure access services that verify every request instead of trusting a network tunnel. The smarter goal is not "VPN or no VPN." The goal is less exposed access, fewer broad permissions, and tighter control per app. That is how you cut risk without making remote work painful.

Related stories. September 21, 2026 Right about the time that tech exec Michael Crean decided to put his company, Solutions Granted, up for sale about three years ago, he noticed an uptick in interest in the managed security service provider business. Tactacam provides cellular-connected trail and security cameras to more than one million subscribers. Addison, Ill.-based Dickson provides environmental monitoring services and serves customers in more than 50 countries. "Security started to become the cool kids club for real," Crean tells Mergers & Acquisitions. "So, there were a lot of people coming around, knocking on the door." After teaming up with adviser Eric McAlpine of Momentum Cyber, Crean sold Solutions Granted to SonicWall, the Milpitas, Calif.-based cybersecurity company backed by Francisco Partners, in a deal announced in November of 2023. Crean, who is now senior vice president of managed services for SonicWall, says interest around acquisition targets in the cybersecurity space has grown even stronger since then, due partly to the increased threat from hackers and scammers armed with tools enhanced with AI. "What we're dealing with the cyber landscape today is war," Crean says. "I think that's probably one reason that we see that the M&A space is incredibly hot. We need better technology to defend our national infrastructure." The best way to improve technology at a company is to build it, partner with it or purchase it through a merger, and buying it "seems like the quickest, most desirable way to go at the moment," he adds. "What we're dealing with in the cyber landscape today is war. I think that's probably one reason we see that the M&A space is incredibly hot." Michael Crean, SonicWall [email protected] During the early part of 2026, larger acquirers focused on add-on deals to grow their scale, and smaller players teamed up to face AI threats. "More deals at lower total value is a clear middle market signal," says Keith Skirbe, a managing director in Houlihan Lokey's technology group. AI Threats To be sure, cybersecurity dealmaking faces some headwinds. The sector faces a "risk-off environment" tied to jitters about AI impacting the software industry, Skirbe says. Trent Hickman, co-managing partner of VSS Capital Partners, says the so-called "SAAS-pocalypse" has led to more caution due to "the question mark about the impact of AI on the underlying software platforms" at cybersecurity companies. But this hasn't kept VSS and other GPs from shopping around the sector. Hickman says VSS has been spending "a lot of time" this year reviewing a cybersecurity business that is focused on implementing and managing so-called zero-trust architecture for commercial and government clients that play a role in U.S. defense. One example of the rising threat level against Uncle Sam came with Anthropic's decision to delay the full release of its new AI software products, Mythos 5 and Fable 5, due to concerns from the company and the U.S. government that they could contain powerful tools for cybercriminals. Anthropic has since released a more secure version of it. "The Department of War's cybersecurity operations and vendors have to be really on the bleeding edge of sophistication here because the threat actors are very much sophisticated and becoming more so every day, particularly with their use of AI," Hickman says. "Their ability to penetrate these defenses is as high as it's ever been." VSS typically invests in companies that generate $5 million to $15 million of Ebitda. From an add-on acquisition perspective, it's a broader range. VSS will also look at smaller deals that will give the firm access to a new geography or product line, or to particularly attractive talent that can fit well strategically and culturally with the existing platform. VSS's potential cybersecurity acquisition would fit the firm's focus on managed services platform companies such as Coretelligent and Centroid, according to Hickman. Along with motivated sellers, cybersecurity M&A continues to receive tailwinds from the growing need for threat protection. Crean says he's seeing "a lot of really good young talent" out there that are doing things that the big players such as Cisco (Nasdaq: CSCO), Check Point Software (Nasdaq: CHKP), Palo Alto Networks (Nasdaq: PANW) or CrowdStrike (Nasdaq: CRWD), haven't thought of yet. "When you start bringing in these new ideas into your business, you start to supercharge your capabilities," Crean says. Skirbe says large cybersecurity vendors will continue to be under pressure from customers drowning in vendor sprawl. "Rather than build, they're acquiring small to mid-sized companies that fill specific capability gaps," he mentions. With deal flow skewing toward smaller tuck-ins and capability acquisitions, leading players have been attracting strong investor interest and commanding premium valuations. Aikido Security, Claroty, Torq and Upwind are all crossing valuation thresholds of more than $1 billion amid continued appetite for platforms, according to Houlihan Lokey (NYSE: HL). Crean says the industry will continue to work to cut down on crime that costs billions. "I dealt with an individual recently who had retired, and unfortunately, he fell for a phishing scam, and he lost millions of dollars. We're talking about a really smart person," Crean says. "Cybersecurity and M&A are not just for the Fortune 500, they're for everyone. It's more important now than it ever has been."

Cybercriminals chain two SonicWall vulnerabilities to break into remote-access appliances. SonicWall disclosed two vulnerabilities in its SMA1000 remote-access appliances on 1 September, and cybercriminals are already exploiting both. CVE-2026-83548 scores a maximum 10.0 out of 10 (Critical) CVSS score and CVE-2026-83549 scores 7.8 (High). Chained together, they let a cybercriminal with no username or password run commands on the appliance. What are these vulnerabilities? An SMA1000 is the gateway staff log in to when they work remotely. It sits at the edge of the network and faces the internet by design. CVE-2026-83548 is a Server-Side Request Forgery (SSRF), a vulnerability that tricks a server into making network requests on an outsider's behalf. SonicWall describes an unintended alternate access path in its Work Place portal, the page employees use to sign in. That path turns the appliance into an unintended forward proxy, relaying an outsider's requests to internal systems that should be out of reach. No login is needed. CVE-2026-83549 sits in SonicWall's Appliance Management Console, the administrator control panel. It is a command injection vulnerability whereby the appliance treats part of a cybercriminal's input as an instruction to its operating system, not as plain data. On its own, it needs an administrator account, but the chain removes that obstacle. The first vulnerability carries the attacker to the management console, and the second one runs the commands. Why this is dangerous A cybercriminal that completes the chain controls the appliance. From there they can: * Read and alter traffic passing through the virtual private network (VPN). * Collect employee credentials as they arrive. * Use the device to reach deeper into the corporate network. Remote-access gateways are a well-known ransomware entry point, because they hold access to everything behind them. SonicWall confirmed cybercriminals exploited both vulnerabilities as zero-days, so attacks began before a patch existed. CISA added the pair to its KEV Catalog on 2 September and US federal agencies had until 5 September to fix them - far shorter than the usual three weeks. SonicWall has not named the group behind the attacks or released indicators of compromise. The Shadowserver Foundation counts more than 400 SMA1000 appliances reachable online. Affected software The vulnerabilities affect SMA1000 models 6210, 7210 and 8200v running platform-hotfix firmware 12.4.3-03453 or earlier, or 12.5.0-02835 or earlier. SonicWall states that SMA 100 series appliances and the SSL-VPN feature on SonicWall firewalls are not affected. Mitigation and next steps Upgrade to 12.4.3-03526 or 12.5.0-02952 or later. SonicWall offers no workaround, so patching is the only fix. Organizations that suspect a breach should re-image the appliance (or re-deploy it if virtual), then reset every user and administrator password along with all time-based one-time password (TOTP) tokens. Need help? If you have any questions, don't hesitate to reach out.