Hackers Actives Scanning SonicWall Firewall Interfaces – 597,000 Sessions Observed

Cybersecuritynews •Abinaya • May 25, 2026

A sharp rise in internet-wide scanning activity targeting SonicWall firewall management interfaces has been detected, raising concerns a potential pre-disclosure reconnaissance phase tied to new vulnerabilities. Threat intelligence firm GreyNoise reported a significant surge in scanning of SonicWall SonicOS management APIs between May 9 and May 18, 2026. The most notable spike occurred on […]

The full story

This article is one source in a clustered incident — the cluster page carries the summary, timeline and every other outlet covering it.

Surge in Scanning Activity Targeting SonicWall Firewalls Raises Alarm A significant increase in scanning activity targeting SonicWall firewall management interfaces has been detected, with nearly 597,000 sessions recorded on May 12, 2026. This spike, reported by threat intelligence firm GreyNoise, is approximately 46 times higher than the typical daily volume observed over the past 90 days. The scanning activity is believed to be part of a reconnaissance phase linked to potential vulnerabilities in SonicWall's SonicOS management APIs. Cybersecurity researchers are concerned that this could precede the exploitation of unpatched vulnerabilities. The exact nature of the vulnerabilities has not been disclosed, and no specific CVEs have been mentioned. The incident highlights the ongoing risks associated with firewall management interfaces and the need for vigilance among organizations using SonicWall products. As of now, the situation remains under observation, with no confirmed exploitation reported. 2 sources 49

Extracted Entities

Hackers Actives Scanning SonicWall Firewall Interfaces – 597,000 Sessions Observed

The full story

Extracted Entities

Companies (1)

MITRE ATT&CK (2)

Platforms (1)