LevelBlue: vulnerability exploitation rose to 14% of initial access
The firm's Q1 figure was 20%, while Verizon's 2026 DBIR put exploitation behind 31% of breaches.
36
Vendor
SonicWall
- Mentions · 7d3
- Mentions · 30d24
- All mentions48
- First seenAug 14, 2026
- Last mentioned1d ago
Timeline
48 articles · newest firstAustralia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
52
SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
28
INC and Gentlemen affiliates used AI agents in ransomware intrusions
Exposed logs show 8,257 messages across 133 sessions and an estimated 62 targets, four of which appeared on leak sites.
78
CISA says SafePay ransomware hit 600+ organizations and wiped backups
The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.
86
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
58
SonicWall security advisory (AV26-1048)
Canada’s Cyber Centre urges patches for multiple flaws in SonicWall NSM On-Prem 4.3.1 and earlier.
36
SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands
SonicWall patched two high-severity NSM On-Prem bugs that can expose data and enable authenticated command execution.
68
ZDI-26-770: SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
ZDI discloses authenticated remote code execution in SonicWall Secure Mobile Access via unzip traversal, CVE-2026-102257.
58
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
86
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 pre-auth SSRF CVE-2026-102255, a CVSS 10.0 flaw with no workaround.
88
CVE-2026-102255: Critical SonicWall SMA1000 SSRF
SonicWall patched critical pre-auth SMA1000 SSRF CVE-2026-102255 after exploitation attempts hit honeypots.
78
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
84
Critical SonicWall Vulnerability Exploited Days After Disclosure
Attackers began exploiting critical SonicWall SMA1000 SSRF CVE-2026-102255 within two days of its October 6 disclosure.
86
Week in review: FortiBleed is still active, Patch Tuesday forecast
CISA added an exploited NetScaler flaw to KEV as Atlassian, Exchange, and SonicWall patches landed amid active attacks.
76
SonicWall and Splunk Patch Critical Vulnerabilities
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000, and Splunk fixed critical command-execution flaws.
68
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.
82
SonicWall security advisory (AV26-1017)
Canada's Cyber Centre warns SonicWall SMA1000 appliances through version 12.5.0 have multiple vulnerabilities and should be updated.
40
SonicWall Fixes Max Severity Pre-Auth Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000 appliances, with no evidence of exploitation.
74
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall patched four SMA 1000 flaws, including an unauthenticated SSRF rated CVSS 10.0.
68
SonicWall warns of max severity SSRF flaw in SMA1000 gateways
SonicWall patches maximum-severity unauthenticated SSRF CVE-2026-102255 in SMA1000 gateways; no exploitation reported.
76
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall patched pre-auth SSRF CVE-2026-102255 in SMA 1000 appliances, with no known exploitation.
70
ESXi Exploitation in the Wild
Huntress stopped an intrusion that used a VMware ESXi VM-escape toolkit after SonicWall VPN access.
81
Metree and WuBook Leaks, SonicWall Access, Campus.gov.il Data, and Kenya Vehicle Database
SOCRadar flags alleged underground leaks of Metree, WuBook, SonicWall access, Campus.gov.il, and Kenya vehicle data.
46
Metasploit Wrap Up: This One Goes to Sixteen!
Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.
48
UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
90
Agents Gone Wild: An AI-Orchestrated Global Campaign Against PaperCut NG/MF
AI-orchestrated campaign exploited PaperCut NG/MF RCE (CVE-2026-81578/82078), compromising 440+ instances at 395 organizations in 48 countries.
82
SonicWall security advisory (AV26-884)
Canada's Cyber Centre issued advisory AV26-884 warning that SonicWall Network Security Manager On-Prem 4.3.0 and earlier are affected by multiple vulnerabilities.
15
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
Security Affairs newsletter Round 593 by Pierluigi Paganini
Security Affairs weekly newsletter round 593 linking to dozens of stories across breaches, ransomware, malware, APTs, and AI security news.
15
Week in review: Claude accounts compromised through infostealer, Patch Tuesday forecast
Help Net Security week-in-review roundup: Claude infostealer lockouts, record Patch Tuesday, McKesson breach, SonicWall zero-days, PaperCut attacks.
28
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
82
CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
82
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
85
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
New SonicWall SMA 1000 zero-days enable unauthenticated remote code execution, with exploitation observed following earlier summer attacks on other SonicWall edge zero-days.
78
SonicWall security advisory (AV26-872) – Update 1
CISA added exploited SonicWall SMA1000 flaws CVE-2026-83548 and CVE-2026-83549 to KEV; admins of affected hotfix versions should patch.
80
Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild
SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.
88
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
78
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
90
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- Zip Slip RCE in SonicWall SMA 1000 AMC
- CVE-2026-1541012%7.2Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
- Authenticated OS command injection in SonicWall SMA1000
- Stored XSS in SonicWall SMA 1000 Management Console
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
Appears with
- CISAorganization · 14
- SMA 1000product · 11
- SonicWallorganization · 10
- SMA1000product · 9
- SonicWall SMA1000product · 7
- Canadian Centre for Cyber Securityorganization · 6
- SonicWall SMA 1000product · 6
- FBIorganization · 5
- Rapid7organization · 5
- Previdianorganization · 4
- Microsoftvendor · 4
- Rapid7vendor · 4
- Trend Microorganization · 3
- KNUCKLEBALLmalware · 3
- Akirathreat actor · 3
- JFrogvendor · 3
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.