In September 2026, security researchers confirmed that SonicWall's enterprise remote-access appliances — the boxes many companies use to let employees connect to the corporate network from home — were being actively exploited through a zero-day chain that required no stolen credentials and no user interaction at all. For attackers, that's close to a master key. For anyone who's ever wondered whether "VPN" always means the same thing, it's a useful moment to draw a sharp line between two very different products that happen to share a name.
Table of Contents
What Happened
SonicWall's remote-access appliances sit at the edge of a corporate network, listening for incoming connections from employees working outside the office. Researchers found that a chain of vulnerabilities in these devices could be exploited by an attacker with no valid login and no need to trick anyone into clicking anything — simply reaching the device over the internet was enough to compromise it. That combination is what security teams mean when they call a bug "pre-auth" and "zero-click": there's no human mistake to blame and no password to have leaked, because none was ever needed.
Why No-Auth, No-Click Bugs Are the Worst Kind
Most breaches still start with something a person did wrong — a reused password, a phished login, a misconfigured account. A pre-auth, unauthenticated exploit chain removes that variable entirely. It doesn't matter how strong your employees' passwords are, whether they have MFA enabled, or how well-trained they are against phishing, because the attacker never needs to interact with a person to get in. That's why these bugs, when found in devices sitting directly on the public internet, tend to be treated as an emergency the moment they're confirmed, rather than a routine patch-cycle item.
Enterprise VPN Appliance vs. the VPN App on Your Phone
It's worth being precise here, because "VPN" gets used as an umbrella term for two fairly different things:
Enterprise Remote-Access Appliance
- A physical or virtual device sitting at a company's network edge
- Runs a listening service, reachable from the open internet, waiting for inbound connections
- A single compromised box can expose an entire internal network
- Patch management is the IT department's job, and delays are common
Consumer VPN App
- An app on your phone or laptop that opens an outbound tunnel to a provider's server
- Doesn't run a service that accepts inbound connections from strangers on the internet
- A compromised app can affect that device's traffic, not a whole organization's network
- Updates come from an app store, typically with far less deployment friction
This isn't a reason to feel invulnerable using a personal VPN app — see our piece on what actually can be compromised on a VPN for the honest risks that do apply. It's simply that the attack surface of "a box on the internet accepting logins from anyone" and "an app that only ever calls out to one server it already trusts" are fundamentally different shapes of risk.
If Your Organization Runs One of These
- Apply the vendor patch immediately — and don't wait for a routine maintenance window given the pre-auth nature of the flaw
- Assume compromise until proven otherwise — check logs for connections predating the patch, since a zero-day may have been exploited before the fix was public
- Isolate and rotate — if compromise is suspected, isolate the device, rotate credentials that may have been reachable from it, and review for lateral movement
- Don't rely on the appliance's own logs alone — a fully compromised device can have tampered logging
The Bigger Pattern Behind the Headline
This isn't an isolated incident for the category. Enterprise VPN and firewall appliances from multiple vendors have repeatedly turned up as the initial entry point in major breaches over the past several years — precisely because they're designed to be reachable from anywhere, which is also what makes them reachable by anyone. The lesson isn't "VPNs are insecure." It's that any device intentionally exposed to the internet carries real, ongoing patch-management responsibility, and organizations that treat perimeter appliances as "set and forget" infrastructure are the ones that end up in next year's breach report.
A Different Shape of VPN
CarrotVPN is a client app, not an internet-facing appliance — it only ever opens an outbound WireGuard® tunnel. Free, with no account required on Android.
Download CarrotVPN Free