Related Threat Clusters
-
SonicWall Patches Actively Exploited Zero-Day Vulnerability CVE-2025-40602
SonicWall has released a patch for the actively exploited zero-day vulnerability CVE-2025-40602, which affects the Appliance Management Console (AMC) of their devices. This vulnerability allows for deserialization of…
4 articles · Updated December 17, 2025 -
Critical SonicWall SMA1000 Vulnerabilities Under Active Exploitation
SonicWall has reported two critical vulnerabilities, CVE-2026-15409 and CVE-2026-15410, affecting its SMA1000 Series appliances, which are currently being actively exploited. The first vulnerability, CVE-2026-15409, is…
62 articles · Updated July 15, 2026 -
Akira Ransomware Group Targets Critical Infrastructure, Extracts $42 Million
The Akira ransomware group has been identified as a significant threat to critical infrastructure, with the U.S. Cybersecurity and Infrastructure Security Agency (CISA) and the FBI warning of its active ransomware…
9 articles · Updated November 14, 2025 -
SonicWall SMA1000 Faces Critical Zero-Day Exploitation
SonicWall disclosed two critical vulnerabilities in its SMA1000 series appliances, CVE-2026-83548 and CVE-2026-83549, which are being actively exploited. CVE-2026-83548 is a pre-authentication server-side request…
40 articles · Updated September 2, 2026 -
Surge in Brute-Force Attacks Targeting SonicWall and Fortinet Devices
In the first quarter of 2026, a significant increase in brute-force authentication attacks was reported, primarily targeting SonicWall and Fortinet FortiGate devices. According to Barracuda, approximately 90% of these…
4 articles · Updated April 15, 2026 -
Multiple Critical Vulnerabilities Exploited in SonicWall and SharePoint Systems
In July 2026, several critical vulnerabilities were exploited, impacting SonicWall SMA1000 appliances and SharePoint servers. Two zero-day vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were discovered in SonicWall…
2 articles · Updated July 28, 2026 -
Ransomware Group Targets SonicWall Gen 7 Firewalls via CVE-2024-40766
In June 2026, a surge in attacks targeting SonicWall Gen 7 firewalls has been reported, exploiting CVE-2024-40766, an improper access control flaw. This vulnerability allows threat actors to gain unauthorized access,…
2 articles · Updated June 23, 2026 -
CVE-2024-40766 Exploited by Ransomware Groups Targeting SonicWall Firewalls
CVE-2024-40766 is an improper access control vulnerability in SonicWall SonicOS affecting Gen 5, Gen 6, and Gen 7 firewalls. The vulnerability, with a CVSS score of 9.3, allows unauthorized access and can crash the…
2 articles · Updated June 23, 2026 -
GreyNoise Report Reveals Early Warning Signals for Edge Device Vulnerabilities
GreyNoise Intelligence has released a report indicating that spikes in malicious activity often precede the disclosure of new vulnerabilities in edge devices. The study tracked 147.8 million sessions over 103 days,…
13 articles · Updated April 20, 2026 -
SonicWall SSL VPN Vulnerability CVE-2024-12802 Actively Exploited Despite Patching
A wave of attacks exploiting CVE-2024-12802, an authentication bypass vulnerability in SonicWall SSL VPN appliances, began in February 2026. Despite a firmware patch issued in 2025, attackers were able to bypass…
6 articles · Updated May 19, 2026
Recent Intelligence Reports
- SonicWall SMA appliances — www.rapid7.com · September 3, 2026
- SonicWall Warns of Two Actively Exploited SMA1000 Zero-Days, One Rated Maximum Severity — Thecyberexpress · September 3, 2026
- SonicWall reports two major security holes under active exploit — Networkworld · September 3, 2026
- CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners — Thehackernews · September 3, 2026
- Remote access Sonicwall SMA1000: Attackers are manipulating internal services — Heise.De · September 2, 2026
- A battery storage cyberattack would look exactly like a badly tuned controller — Helpnetsecurity · September 2, 2026
- SonicWall SMA1000 Hacked Third Time; MFA Seeds Stolen in July Outlast September Patches — Techtimes · September 2, 2026
- Remote Access Sonicwall SMA1000: Attackers Bend Internal Services — www.heise.de · September 2, 2026