Arctic Wolf Observes Authentication Bypass Exploitation Attempts Targeting SonicWall Firewalls (CVE-2024-53704)

**Executive summary:** CVE-2024-53704 is a high-severity authentication bypass in SonicOS SSLVPN that can allow unauthenticated actors to bypass MFA, disclose sensitive information, and interrupt VPN sessions; a public PoC was released (10 Feb 2025) and Arctic Wolf observed exploitation attempts, with historical linkage to Akira ransomware affiliates using SonicWall SSL VPN accounts for initial access—organizations should upgrade to the fixed SonicOS versions and restrict SSLVPN exposure.