Search: “Spark Firewall”

Cisco Secure Firewall Management Center Software Java Deserialization Remote Code Execution Vulnerability

Cisco fixed an unauthenticated Java deserialization RCE in FMC's External Database Access feature allowing root command execution via a TCP port.

Insecure deserialization of a user-supplied Java byte stream in Cisco Secure Firewall Management Center's External Database Access feature lets an unauthenticated remote attacker execute arbitrary commands and elevate to root. Exploitation requires sending a crafted serialized stream to a specific TCP port from a host configured in the external database access list. Cisco has released software updates.

Cisco Security Advisories·16:00 UTC · 1h agoAdvisory 6 sources

Cisco Secure Firewall Threat Defense Software TLS 1.3 Denial of Service Vulnerability

A TLS 1.3 buffer management flaw in Cisco Secure Firewall Threat Defense lets remote attackers crash the LINA process and reload devices.

A vulnerability in the TLS 1.3 implementation of Cisco Secure Firewall Threat Defense (FTD) software allows an unauthenticated remote attacker to cause a denial of service via crafted TLS 1.3 packets sent to a TLS 1.3-enabled listening socket. Improper buffer management causes the LINA process to crash, forcing a device reload that can occur before or after connection authentication. Cisco has released software updates to address the flaw.

Cisco Security Advisories·16:00 UTC · 1h agoAdvisory 9 sources

Check Point Patches Critical VPN Vulnerabilities

Check Point patches two critical unauthenticated RCE flaws (CVE-2026-85102, CVE-2026-85103) in VPN gateways and firewalls; no exploitation observed.

Check Point released patches for CVE-2026-85102 and CVE-2026-85103, two critical vulnerabilities (CVSS 9.8) enabling unauthenticated remote code execution in products using VPN functionality. CVE-2026-85102 involves improper validation of certificate data during VPN negotiation, while CVE-2026-85103 is a heap overflow in the VPN certificate ASN.1 decoding flow. Updates cover versions R82.10, R82, and R81.20; manually defining VPN rules is offered as a mitigation, though it does not apply to locally managed Spark Firewall instances. Check Point discovered both flaws internally and reports no evidence of exploitation in the wild.

SecurityWeek·updated Sep 14, 09:43 UTC · 2d ago·first Sep 11, 11:10 UTC · 5d agoVulnerability 9 sourcesCVE-2026-85102CVE-2026-85103CVE-2026-16232+1 CVEs1

UK Council Attack Linked to Mass Exploitation of SonicWall Flaw

Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.

Hunt.io links, with moderate confidence, the July 17, 2026 attack on the Borough Council of King's Lynn and West Norfolk to mass exploitation of SonicWall SMA1000 appliances via CVE-2026-15409, an unauthenticated SSRF in the WorkPlace portal WebSocket proxy with CVSS 10.0. The operator adapted Rapid7's July 15 PoC into a 50-thread mass scanner within days and stole LDAP credentials for 534 Active Directory accounts across 160 domains, with nine environments losing SAM/LSA secrets and five losing full AD databases via DCSync. CISA added the flaw to its Known Exploited Vulnerabilities catalog and noted use in ransomware campaigns; targeting of ~200,000 Shodan-derived SonicWall addresses spanned government, healthcare, finance, universities, and manufacturing worldwide.

Security Affairs·Sep 11, 07:11 UTC · 5d agoExploit / PoC in the wildCVE-2026-154091

AWS makes it easier to spot firewall rules that have gone quiet

AWS Network Firewall added rule hit counts for stateful rules, letting teams identify unused rules and validate control effectiveness at no added cost.

AWS Network Firewall's rule hit count capability gives security teams visibility into which stateful firewall rules are matching traffic, helping identify unused or redundant rules and validate controls for compliance frameworks like PCI DSS 4.0 and DORA. The feature covers stateful rules in custom and managed rule groups, is enabled by default at no additional Network Firewall cost, and is available in all supported Regions except UAE and Bahrain. Data is surfaced in the Network Firewall dashboard's Top Rule Hits view and can be queried via CloudWatch Logs Insights or Amazon Athena.

Help Net Security·Aug 24, 00:00 UTC · 23d agoTools

ZDI-26-532: SonicWall Email Security updateNetIf Command Injection Local Privilege Escalation Vulnerability

ZDI advisory ZDI-26-532 discloses CVE-2026-66149, a command injection in SonicWall Email Security updateNetIf allowing local privilege escalation (CVSS 7.8).

SonicWall Email Security contains a command injection flaw in the updateNetIf routine, tracked as CVE-2026-66149 with CVSS 7.8. A local attacker must first obtain the ability to execute low-privileged code on the target system in order to escalate privileges. The vulnerability was disclosed via ZDI advisory ZDI-26-532.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-66149

Metasploit Wrap Up: This One Goes to Sixteen!

Metasploit adds 16 modules including 10 exploits, five covering CISA KEV vulnerabilities in Cisco, SonicWall, PaperCut, JetBrains and Langflow.

Rapid7's weekly Metasploit update ships 16 new modules, 10 of them exploit modules, with five targeting CISA KEV entries. New exploits cover Cisco Secure Firewall Management Center auth bypass (CVE-2026-20079), a SonicWall SMA1000 SSRF-to-root RCE chain (CVE-2026-83548/CVE-2026-83549), JetBrains TeamCity deserialization RCE (CVE-2026-63077), PaperCut NG/MF chain (CVE-2026-81578/CVE-2026-82078), and Langflow authenticated RCE (CVE-2026-19295). The SonicWall and PaperCut chains were reported as actively exploited zero-days, and a new ESC8 relay module exploits CVE-2026-20929 against AD CS Web Enrollment.

Rapid7 Blog·Sep 11, 13:35 UTC · 5d agoTools in the wildCVE-2025-66516CVE-2025-54988CVE-2026-20929+8 CVEs1

Hackers Chain Two New SonicWall Zero-Day Vulnerabilities

SonicWall warns two zero-days (CVE-2026-83548 SSRF, CVE-2026-83549 post-auth RCE) in SMA1000 appliances are being actively exploited.

A September 1 SonicWall advisory discloses actively exploited zero-days in SMA1000 appliance models 6210, 7210 and 8200v, affecting platform-hotfix versions 12.4.3-03453 and 12.5.0-02835 and older. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface via an unintended alternate access path; CVE-2026-83549 (CVSS 7.8) is post-authentication OS command injection enabling RCE in the Appliance Management Console. SonicWall urges hotfix upgrades, IOC checks with SonicWall support, and re-imaging plus credential and TOTP resets if compromise is found.

Infosecurity Magazine·Sep 2, 09:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

Attackers exploit zero-days in consistently besieged SonicWall product

Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.

SonicWall disclosed and patched two zero-days in SMA 1000 appliances: CVE-2026-83548, a maximum-severity pre-authentication SSRF, and CVE-2026-83549, a high-severity OS command injection. Rapid7 said chaining the flaws yields unauthenticated remote code execution, and CISA added both to its KEV catalog Wednesday. The vendor provided no IOCs or victim counts, urging customers to hunt for compromise, reimage or redeploy appliances, and reset all passwords and tokens. The product has faced repeated exploitation, including ransomware-linked flaws used by INC and Akira.

CyberScoop·Sep 3, 22:12 UTC · 12d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain

SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.

SonicWall fixed CVE-2026-83548 (CVSS 10.0), a pre-authentication SSRF in the Appliance Work Place interface, and CVE-2026-83549 (CVSS 7.8), a post-authentication OS command injection in the Appliance Management Console. The company investigated a case indicating active exploitation, suggesting attackers chained both bugs to execute arbitrary code on susceptible devices. Affected SMA 1000 models 6210, 7210, and 8200v require hotfixes 12.4.3-03526 or 12.5.0-02952; customers are urged to hunt for IoCs and re-image, reset credentials, and rotate TOTP if found.

The Hacker News·Sep 2, 10:53 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-15409+1 CVEs

SonicWall's SMA1000 boxes under active attack again

SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.

SonicWall says attackers are actively exploiting two chained zero-days in SMA 1000 appliances: CVE-2026-83548, a pre-authentication SSRF rated CVSS 10.0, and CVE-2026-83549, a post-authentication OS command injection (CVSS 7.8) in the Appliance Management Console. Hotfixes are available for SMA 6210, 7210, and 8200v appliances with no workarounds; SonicWall recommends reimaging compromised devices, rotating passwords, and resetting TOTP tokens. NHS England assesses further exploitation as almost certain, following a similar exploited pair in July when CISA added CVE-2026-15409 to its KEV catalog.

The Register · Security·Sep 2, 16:05 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-15409

SonicWall security advisory (AV26-872) – Update 1

CISA added exploited SonicWall SMA1000 flaws CVE-2026-83548 and CVE-2026-83549 to KEV; admins of affected hotfix versions should patch.

Canada's Cyber Centre (advisory AV26-872, Update 1) relays a SonicWall advisory for SMA1000 appliances (6210, 7210, 8200v), stating CVE-2026-83548 and CVE-2026-83549 are being exploited. CISA added both flaws to its Known Exploited Vulnerabilities catalog on September 2, 2026. Affected versions include platform-hotfix 12.4.3-03453 and 12.5.0-02835 and older; administrators should apply available updates.

Canadian Centre for Cyber Security·Sep 2, 18:44 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

Critical SonicWall SMA1000 Vulnerabilities CVE-2026-83548, CVE-2026-83549 Exploited in the Wild

SonicWall SMA1000 appliances face active exploitation of chained CVE-2026-83548 and CVE-2026-83549 enabling unauthenticated RCE; hotfixes released.

SonicWall disclosed on September 1, 2026 that CVE-2026-83548, a critical pre-authentication SSRF in the SMA1000 Appliance Work Place interface (CVSS 10.0), and CVE-2026-83549, an authenticated OS command injection in the Appliance Management Console, can be chained for unauthenticated remote code execution. Both vulnerabilities are confirmed exploited in the wild and were added to CISA's Known Exploited Vulnerabilities catalog. Affected SMA1000 models 6210, 7210 and 8200v on versions 12.4.3-03453 and 12.5.0-02835 platform-hotfix or earlier require upgrades to 12.4.3-03526 or 12.5.0-02952 platform-hotfixes.

Rapid7 Blog·Sep 2, 16:58 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

Prolific ransomware group behind SonicWall zero

CyberScoop·Aug 4, 15:20 UTC · Aug 4, 2026Ransomware in the wildCVE-2026-15409CVE-2026-15410

SonicWall Patches Two New Actively Exploited Zero

SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.

SonicWall released hotfixes for two zero-day vulnerabilities in its SMA 1000 VPN appliances, with SonicWall PSIRT confirming active exploitation in the wild. CVE-2026-83548 (CVSS 10.0) is a pre-authentication SSRF in the Appliance Work Place interface allowing unauthenticated unauthorized operations; CVE-2026-83549 (CVSS 7.8) is a post-authentication OS command injection in the Appliance Management Console enabling arbitrary command execution and RCE. The flaws affect models 6210, 7210 and 8200v running 12.4.3-03453 or earlier and 12.5.0-02835 or earlier, fixed in versions 12.4.3-03526 and 12.5.0-02952. This follows a July Volexity report on threat actor UTA0533 chaining two SMA 1000 zero-days to gain root access and deploy the KNUCKLEBALL Python backdoor.

Security Affairs·Sep 2, 14:22 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-15409+1 CVEs1

SonicWall security advisory (AV26-853)

Canada's Cyber Centre relays a SonicWall advisory flagging vulnerabilities in NetExtender Linux Client 3.5 and earlier, urging administrators to apply updates as available.

The Canadian Centre for Cyber Security issued advisory AV26-853, noting SonicWall vulnerabilities affecting NetExtender Linux Client version 3.5 and earlier as of August 25, 2026. The relay provides no CVE identifiers or exploitation details and directs users and administrators to review SonicWall's security advisories and apply updates as they become available.

Canadian Centre for Cyber Security·Aug 27, 12:44 UTC · 20d agoAdvisory

ZDI-26-530: SonicWall Email Security snmp Command Injection Local Privilege Escalation Vulnerability

ZDI advisory discloses SonicWall Email Security snmp command injection local privilege escalation (CVE-2026-66150, CVSS 7.8).

ZDI advisory ZDI-26-530 describes a command injection vulnerability in the snmp component of SonicWall Email Security, tracked as CVE-2026-66150 with a CVSS score of 7.8. Local attackers who can already execute low-privileged code on the target can escalate privileges on affected installations.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026AdvisoryCVE-2026-66150

CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners

CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.

CISA's KEV additions cover flaws in SonicWall SMA 1000 (CVE-2026-83548, CVE-2026-83549), Sangoma Switchvox (CVE-2026-9586), JFrog Artifactory (CVE-2026-82329), Kludex Starlette (CVE-2026-48710), Kestra OSS (CVE-2026-49869) and Berri LiteLLM's MCP endpoint (CVE-2026-59822). SonicWall confirmed active exploitation of the SMA 1000 flaws, while Microsoft and Wiz reported attackers chaining LiteLLM flaws CVE-2026-42271 and CVE-2026-48710 to fingerprint hosts, steal provider API keys and deploy XMRig miners on AI infrastructure. Wiz linked exploitation of the LiteLLM chain to the Qilin ransomware group, and Microsoft detailed a Kestra compromise chain ending in cryptocurrency mining and data harvesting via exposed RAGFlow flaws.

The Hacker News·Sep 3, 05:19 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549CVE-2026-9586+10 CVEs1

ZDI-26-531: SonicWall GMS Virtual Appliance interface Command Injection Local Privilege Escalation Vulnerability

ZDI discloses CVE-2026-66148, a command injection local privilege escalation in SonicWall GMS Virtual Appliance rated CVSS 7.8.

ZDI-26-531 describes a command injection vulnerability in the SonicWall GMS Virtual Appliance interface that allows local attackers to escalate privileges. Exploitation requires the attacker to first execute low-privileged code on the target system. ZDI assigned a CVSS score of 7.8, tracked as CVE-2026-66148.

ZDI Published Advisories·Aug 11, 05:00 UTC · Aug 11, 2026VulnerabilityCVE-2026-66148

CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)

CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.

CISA added CVE-2026-83548 and CVE-2026-83549 to the Known Exploited Vulnerabilities Catalog with a September 5, 2026 patch deadline. CVE-2026-83548 is a critical (CVSS 10.0) pre-authentication SSRF in the SMA1000 Appliance Work Place interface; CVE-2026-83549 is a high (CVSS 7.8) post-authentication OS command injection leading to RCE in the Appliance Management Console. SMA1000 models 6210, 7210, and 8200v running 12.4.3-03453 or 12.5.0-02835 platform-hotfix and older are affected; fixes ship in 12.4.3-03526 and 12.5.0-02952. Qualys customers can detect vulnerable assets via QID 388624.

Qualys ThreatPROTECT·Sep 3, 13:09 UTC · 13d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

SonicWall SMA 1000 appliances under attack via zero-day flaws

SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.

SonicWall confirmed attackers are actively exploiting two previously undisclosed vulnerabilities in SMA 1000 SSL VPN appliances, affecting physical and virtual models 6210, 7210, and 8200v but not SMA 100 appliances or SonicWall firewalls. CVE-2026-83548 is a pre-authentication SSRF in the Appliance Work Place interface allowing remote unauthenticated attackers to gain unauthorized access to sensitive functionality, while CVE-2026-83549 is an OS command injection in the Appliance Management Console that can yield remote code execution under specific conditions for authenticated admins. The vendor urged immediate hotfix deployment, IoC review with technical support, and re-imaging or redeployment plus password and TOTP token resets on confirmed compromise. This is the latest in a series of zero-day attacks against SMA 1000 appliances following waves in late 2025 and June-July 2026.

Help Net Security·Sep 2, 00:00 UTC · 14d agoExploit / PoC in the wildCVE-2026-83548CVE-2026-83549

Cisco Secure Firewall Management Center Software Static Credential Vulnerability

Cisco warns of static low-privileged credentials in Secure Firewall Management Center's web interface, letting unauthenticated remote attackers log in and access sensitive data.

Cisco disclosed a vulnerability in the web interface of Secure Firewall Management Center (FMC) Software caused by the presence of static credentials for a low-privileged account. An unauthenticated remote attacker could log in to an affected device using the static account and access sensitive data within impacted systems. The attack surface is reduced when the FMC management interface does not have public internet access.

Cisco Security Advisories·Aug 11, 19:01 UTC · Aug 11, 2026Advisory

Hackers Actively Exploiting FortiGate Firewalls to Deploy Custom Node.js Malware

Attackers actively exploit CVE-2025-25249 in FortiGate firewalls to deploy PivotC2, a Node.js RAT that decrypts VPN and admin credentials.

SOCRadar assesses with high confidence that threat actors are actively exploiting CVE-2025-25249, a CVSS 9.8 heap buffer overflow in the cw_acd daemon (CAPWAP, UDP 5246) affecting FortiOS 6.4-7.6.3 and FortiSwitchManager 7.0.x/7.2.x. Attackers deploy fortirun.bin and PivotC2, a Node.js post-exploitation framework that harvests configurations and decrypts SSL-VPN, wireless, and admin credentials using AES-256-CBC and AES-128-GCM. Over 30,000 FortiGate IPs were scanned and 178 devices compromised, including two confirmed full intrusions of US organizations with Exchange mailbox exfiltration to Wasabi storage. STRU attributes the campaign to a Russian-speaking, financially motivated cybercrime operator.

Cyber Security News·Sep 8, 16:50 UTC · 8d agoExploit / PoC in the wildCVE-2025-252491

Metasploit Wrap Up: Lot of summer shells and fit http profiles

Metasploit 6.5 ships 13 new modules including RCEs for SonicWall SMA1000, Ghost CMS, Joomla JCE and Langflow, plus a Linux kernel LPE.

Rapid7's Metasploit wrap-up covers the 6.5 release, which adds 13 new modules, including remote code execution exploits for WordPress WP2Shell, Ghost CMS, Joomla JCE, Langflow, OpenCATS, Pterodactyl Panel, SonicWall SMA1000, Ray Dashboard and a Pix-for-WooCommerce plugin. The Fragnesia Linux kernel local privilege escalation (CVE-2026-46300) also landed. The release introduces HTTP malleable profiles, MCP functionality, Linux multi-fetch payloads and improved Windows on ARM support.

Rapid7 Blog·Aug 14, 21:27 UTC · Aug 14, 2026ToolsCVE-2026-46300

SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE

New SonicWall SMA 1000 zero-days enable unauthenticated remote code execution, with exploitation observed following earlier summer attacks on other SonicWall edge zero-days.

Zero-day vulnerabilities in SonicWall's SMA 1000 secure access appliances allow unauthenticated remote code execution, and exploitation activity is being observed. This follows attacks earlier in the summer that abused two other zero-day vulnerabilities in SonicWall edge devices. Internet-facing appliances used for remote access make this an urgent patching priority for defenders.

Dark Reading·Sep 2, 20:43 UTC · 13d agoExploit / PoC in the wild

Marimo RCE Flaw Lets Hackers Steal AWS Credentials and Pivot to Bastion Host in 8 Seconds

Attacker exploited unauthenticated marimo WebSocket RCE CVE-2026-39987 to steal AWS credentials and SSH into a bastion host in eight seconds.

Sysdig Threat Research Team documented a real intrusion exploiting CVE-2026-39987 in marimo (versions up to 0.20.4, fixed in 0.23.0), where the unauthenticated /terminal/ws WebSocket endpoint exposed an interactive shell. Within eight seconds the attacker pulled AWS credentials from Redis, extracted an SSH private key from AWS Secrets Manager via Boto3, and authenticated to a bastion host; over nine hours the operator ran 850+ commands using a staged custom Python toolkit. Blocked EC2 Instance Connect attempts (SendSSHPublicKey to placeholder instance i-0000000000000000) provide a high-confidence detection signal.

GBHackers·updated Sep 15, 11:52 UTC · 1d ago·first Sep 15, 09:58 UTC · 1d agoExploit / PoC in the wild 4 sourcesCVE-2026-399872· 1 read

U.S. CISA adds Metabase, Windows, and Cisco Secure Firewall flaws to its Known Exploited Vulnerabilities catalog.

CISA adds three actively exploited flaws—Cisco ASA/FTD DoS, Windows Winsock SYSTEM-level UAF, and Metabase SQL injection—to its Known Exploited Vulnerabilities catalog.

CISA added CVE-2026-20349 (CVSS 8.6, heap inspection flaw crashing Cisco ASA/FTD via crafted HTTP requests to the Remote Access SSL VPN service), CVE-2026-68820 (CVSS 7.0, use-after-free in the Windows afd.sys Winsock driver allowing SYSTEM-privilege code execution, actively exploited per Microsoft) and CVE-2026-72898 (CVSS 10.0, unauthenticated SQL injection in Metabase) to the KEV catalog. Metabase disclosed its cloud service was attacked with the 0-day, giving the intruder a path to administrator rights and stored credentials for connected databases; cloud instances were patched while self-hosted deployments need urgent updates. Under BOD 22-01, federal civilian agencies must patch by August 14, 2026, except CVE-2026-68820, due August 25.

Security Affairs·Aug 18, 18:15 UTC · 28d agoExploit / PoC in the wildCVE-2026-20349CVE-2026-68820CVE-2026-728981