Threat Feed
Daily intelligence on vulnerabilities, threat actors and geopolitical context — distilled from primary sources.
Filtered Reports
17 / 17 results
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-102255) exploited 135 times
SonicWall Secure Mobile Access (SMA) 1000 appliances. Patched in versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix) released October 6, 2026. All prior versions vulnerable.
criticalbug_reportVulnerabilitySonicWall SMA1000 CVE-2026-102255 exploited 3 days after patch release
SonicWall SMA1000 models 6210, 7210, and 8200v. The vulnerability affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are NOT affected. Over 400 SMA1000 appliances exposed online per Shadowserver tracking.
criticalbug_reportVulnerabilitySonicWall SMA1000 CVSS 10.0 pre-auth SSRF allows internal access
SonicWall SMA1000 appliances (models 6210, 7210, 8200v) running platform-hotfix versions 12.4.3-03526 and older, or 12.5.0-02952 and older. The critical flaw (CVE-2026-102255) affects the WorkPlace portal.
criticalbug_reportVulnerabilitySonicWall SMA1000 pre-auth SSRF and post-auth RCE require urgent patching
SonicWall SMA1000 series appliances. Specific affected versions not provided in source material. Two vulnerabilities: pre-authentication SSRF and post-authentication RCE.
criticalbug_reportVulnerabilitySonicWall SMA1000 gateways vulnerable to unauthenticated SSRF flaw
SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
highbug_reportVulnerabilitySonicWall Network Security Manager vulnerability requires immediate patching
SonicWall Network Security Manager (NSM). Specific affected versions not disclosed in available advisory. CVE identifier not yet assigned or not publicly disclosed.
criticalbug_reportVulnerabilitySonicWall SMA 1000 SSRF flaw (CVE-2026-83548) exploited in the wild
SonicWall SMA 1000 Appliances. CVE-2026-83548 is a server-side request forgery (SSRF) vulnerability with CVSS 10.0, allowing remote unauthenticated attackers to gain unauthorized access. Specific affected versions not disclosed.
criticalbug_reportVulnerabilitySonicWall SMA1000 RCE vulnerabilities under active exploitation
SonicWall SMA1000 series appliances. Specific affected versions not disclosed in available information. Vulnerabilities enable remote code execution.
criticalbug_reportVulnerabilitySonicWall SMA 1000 VPN zero-days exploited in chained attacks
SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances: models 6210, 7210, and 8200v running versions 12.4.3-03453 and older, or 12.5.0-02835 and older.
criticalbug_reportVulnerabilitySonicWall SMA1000 zero-days CVE-2026-83548/83549 chained for RCE
SonicWall SMA1000 appliances (models 6210, 7210, 8200v). Does not affect SSL-VPN on SonicWall firewalls or SMA 100 Series. Approximately 400+ appliances exposed online per Shadowserver tracking.
criticalbug_reportVulnerabilitySonicWall GMS unauthenticated RCE flaws require immediate patching
SonicWall Global Management System (GMS). Specific affected versions not disclosed in available data. Both CVE-2026-66145 and CVE-2026-66147 enable unauthenticated remote code execution.
criticalperson_alertThreat ActorRansomware Gangs Exploit SonicWall SMA1000 SSRF and Auth Bypass Flaws
The actors are ransomware gangs—a broad category of financially motivated cybercrime operators—actively exploiting recently patched SonicWall SMA1000 vulnerabilities.
highperson_alertThreat ActorINC Ransomware Exploits SonicWall SMA 1000 Zero-Days
INC Ransomware is a cybercrime operation conducting data extortion and ransomware attacks. The group has claimed 885 victims to date as of August 2, 2026, according to Ransomware.Live statistics.
criticalbug_reportVulnerabilitySonicWall SMA1000 VPN appliances exploited via two zero-day flaws
SonicWall SMA1000 series VPN appliances. Specific vulnerable versions not disclosed. Affects enterprise VPN infrastructure using these devices.
criticalbug_reportVulnerabilitySonicWall SMA 1000 VPN zero-days exploited by UTA0533 for root access
SonicWall Secure Mobile Access (SMA) 1000 series VPN appliances. Specific vulnerable versions not disclosed. All SMA 1000 deployments should be considered at risk until vendor guidance is available.
criticalbug_reportVulnerabilitySonicWall Gen6 SSL-VPN exploited for credential brute-force and MFA bypass
SonicWall Gen6 SSL-VPN appliances with incomplete patching. Specific firmware versions not disclosed. Affects organizations using SonicWall SSL-VPN for remote access.
highbug_reportVulnerabilitySonicWall releases patches for multiple high-severity vulnerabilities
SonicWall products (specific models and versions not disclosed in summary). CERT.BE advisory indicates multiple vulnerabilities requiring immediate patching across SonicWall product line.