SonicWall patches seven SonicOS firewall flaws; CISA lists SAML bypass
Five of the Gen 7 and Gen 8 bugs allow unauthenticated remote attacks; only CVE-2026-19868 has a workaround.
Stories per day · 30 days
9 RSS
Relatedkev8cisa7saml7sonicos6ssl-vpn6sslvpn6mfa5authentication-bypass3cisa-kev2gms2honeypot2mfa-bypass2nsm2rce2access-control1advisory1akira1android1
52 stories, newest first · one card per story
Stories tagged #sonicwall
Threat bulletin covers library ransomware and exploited SonicWall, OpenSSH flaws
SonicOS SAML VPN bypass and OpenSSH before 10.6p2 are described as actively exploited; Android 14–17 RCE is also patched.
4
SonicWall SSL-VPN MFA bypass flaw exploited in attacks
CISA added CVE-2026-19868 to KEV after exploitation; affects SonicOS SSL-VPN with SAML MFA
1
SonicWall SSL-VPN flaw CVE-2026-19868 can bypass SAML MFA
SonicWall calls exploitation only potential; Gen7 through 7.3.3-7015 and Gen8 through 8.2.2-8015 need firmware, with no workaround.
CISA adds CVE-2026-19868 to Known Exploited Vulnerabilities Catalog
CISA has added CVE-2026-19868, affecting SonicWall SonicOS, to its KEV Catalog due to active exploitation.
Cisco and WatchGuard release patches; SonicWall leaves GMS unpatched
SonicWall will not patch two critical flaws in its end-of-life Global Management System.
1
SonicWall GMS Flaws Unpatched After End of Life
SonicWall GMS has unpatched flaws after reaching end of life, exposing devices to risks.
SonicWall will not patch end-of-life GMS flaws
SonicWall confirmed two vulnerabilities in end-of-life Global Management System that will not be fixed.
Australia’s ASD issued more than 4,400 cyber warnings in a year
Victim reports helped disrupt an August 2025 Akira campaign linked to a known SonicWall flaw.
1
SANS diary uses Kibana to hunt odd HTTP charsets in honeypot logs
A DShield honeypot logged about 960,000 events in three weeks, and Accept-Charset GBK stood out on SonicWall login probes.
CISA says SafePay ransomware hit 600+ organizations and wiped backups
The October 20 joint advisory covers activity since August 2024 and five exploited CVEs, including critical CVE-2024-40711.
The Q3 Vulnerability Pulse: Discovery ≠ Exploitation
Talos says 2026 CVE volume passed 70,000 while KEV growth lagged, so discovery is not exploitation.
SonicWall security advisory (AV26-1048)
Canada’s Cyber Centre urges patches for multiple flaws in SonicWall NSM On-Prem 4.3.1 and earlier.
SonicWall NSM Bugs Let Attackers Intercept Communications and Execute Commands
SonicWall patched two high-severity NSM On-Prem bugs that can expose data and enable authenticated command execution.
ZDI-26-770: SonicWall Secure Mobile Access unzip Directory Traversal Remote Code Execution Vulnerability
ZDI discloses authenticated remote code execution in SonicWall Secure Mobile Access via unzip traversal, CVE-2026-102257.
Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 pre-auth SSRF CVE-2026-102255, a CVSS 10.0 flaw with no workaround.
CVE-2026-102255: Critical SonicWall SMA1000 SSRF
SonicWall patched critical pre-auth SMA1000 SSRF CVE-2026-102255 after exploitation attempts hit honeypots.
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
Critical SonicWall Vulnerability Exploited Days After Disclosure
Attackers began exploiting critical SonicWall SMA1000 SSRF CVE-2026-102255 within two days of its October 6 disclosure.
Week in review: FortiBleed is still active, Patch Tuesday forecast
CISA added an exploited NetScaler flaw to KEV as Atlassian, Exchange, and SonicWall patches landed amid active attacks.
15
Max severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
SonicWall and Splunk Patch Critical Vulnerabilities
SonicWall patched a CVSS 10 pre-auth SSRF in SMA1000, and Splunk fixed critical command-execution flaws.
SonicWall’s latest critical flaw indicates a security pattern, not another one-off bug
SonicWall disclosed a CVSS 10 pre-auth SSRF in SMA1000, with no confirmed exploitation yet.