CVE-2024-12802 SonicWall Gen6 SSL-VPN MFA Bypass Actively Exploited by Ransomware-Linked IAB — Firmware Patch Alone Insufficient Due to Six Missed LDAP Reconfiguration Steps

ReliaQuest confirmed the first known in-the-wild exploitation of CVE-2024-12802 across multiple environments between February and March 2026 — attackers brute-forced VPN credentials in as few as 13 attempts and silently bypassed MFA with no failed-login alerts, as the flaw exploits separate UPN vs. SAM Active Directory login handling. In at least one intrusion, threat actors reached a file server and deployed pre-ransomware staging tools (consistent with Akira) within 30 minutes of VPN access. The critical detection gap: the firmware patch exists but requires six manual LDAP reconfiguration steps that standard patch-management workflows do not verify — devices appear fully remediated but remain exploitable. Gen6 appliances reached end-of-life April 16, 2026 and will receive no further patches; defenders should add `sess='CLI'` to SonicWall log monitoring and audit Event IDs 238 and 1080 as immediate threat hunting priorities.

In at least one intrusion, threat actors reached a file server and deployed pre-ransomware staging tools (consistent with Akira) within 30 minutes of VPN access.

This intelligence brief has been compiled from open-source reporting and corroborated across multiple threat intelligence sources. Defenders should treat the high severity rating as a guide to prioritization within their environment.

For the latest indicators of compromise, formatted SIEM queries, and unredacted actor intelligence related to this brief, DMZ Operator subscribers receive automated IOC packages via email the moment new advisories are published.