Surge in Scanning Activity Targeting SonicWall Firewalls Raises Alarm

A significant increase in scanning activity targeting SonicWall firewall management interfaces has been detected, with nearly 597,000 sessions recorded on May 12, 2026. This spike, reported by threat intelligence firm GreyNoise, is approximately 46 times higher than the typical daily volume observed over the past 90 days. The scanning activity is believed to be part of a reconnaissance phase linked to potential vulnerabilities in SonicWall's SonicOS management APIs. Cybersecurity researchers are concerned that this could precede the exploitation of unpatched vulnerabilities. The exact nature of the vulnerabilities has not been disclosed, and no specific CVEs have been mentioned. The incident highlights the ongoing risks associated with firewall management interfaces and the need for vigilance among organizations using SonicWall products. As of now, the situation remains under observation, with no confirmed exploitation reported.

Key Points: • Nearly 597,000 scanning sessions targeting SonicWall firewalls were recorded on May 12, 2026. • The scanning activity is approximately 46 times higher than the typical daily volume in the last 90 days. • No specific vulnerabilities or CVEs have been disclosed, but concerns about potential exploitation are rising.