# SonicWall, MFA Bypass, IABs: Why Patched Devices Are Still Handing Attackers Initial Access

Page: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access
Text version: https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access.md
Podcast: [ShadowTalk: Powered by ReliaQuest](https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547)
Published: 2026-06-03T19:00:00+00:00
Episode link: https://www.buzzsprout.com/2154459/episodes/19289336-sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access.mp3
Audio file: https://www.buzzsprout.com/2154459/episodes/19289336-sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access.mp3
Processing state: not_requested
JSON: https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access
Duration seconds: 1251

## Resource

Your team patches the device. The firmware version matches the advisory. The ticket closes. The device comes off the remediation queue. What your workflow never tracked is that the advisory also required six manual LDAP configuration steps — and without them, the authentication bypass still works. An initial access broker authenticated through the VPN, reached a domain-joined file server, and was gone in under 40 minutes. Your dashboard still showed a clean queue. With initial access brokers ...

## Actions

- request_transcript: `POST https://stenobird.com/v1/public/podcasts/shadowtalk-powered-by-reliaquest-61547/episodes/sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access/transcription-requests` — Idempotently request low-priority transcript generation for this episode.
- read_markdown: `GET https://stenobird.com/podcast/shadowtalk-powered-by-reliaquest-61547/sonicwall-mfa-bypass-iabs-why-patched-devices-are-still-handing-attackers-initial-access.md` — Read the agent-friendly Markdown representation of this episode resource.

A page view does not enqueue transcription. Agents should invoke `request_transcript` explicitly when they need this episode processed.

## Transcript

Full transcripts are not published on public pages unless there is a clear rights basis.