Threat Intel
SonicWall SonicOS Management Interface Scanning Spike Signals Potential Vulnerability Exposure
GreyNoise detected a record 597,000 scanning sessions against SonicWall SonicOS API interfaces on May 12, 2026, a 46× increase over normal levels. The spike mirrors patterns that preceded CVE‑2026‑0400, suggesting defenders should review SonicWall firmware, enable logging, and monitor for exploitation attempts.
What happened
Between May 9 and 18, 2026 GreyNoise recorded a surge of scanning activity against SonicWall SonicOS management interfaces. The peak on May 12 reached roughly 597,000 sessions, about 46 times the daily average seen in the month prior.
Impact
Similar spikes have historically preceded the disclosure of SonicWall vulnerabilities, most notably the CVE‑2026‑0400 exploit that was publicly disclosed on February 24, 2026. While the current spike does not confirm a new flaw, it indicates that adversaries are probing for weaknesses in the same API surface.
What to do
- Verify that all SonicWall appliances run the latest firmware and that known CVE‑2026‑0400 mitigations are applied.
- Enable detailed logging on SonicOS API endpoints and monitor for repeated connection attempts from unfamiliar IPs.
- Deploy GreyNoise or equivalent threat intelligence feeds to detect and block scanning traffic in real time.
- Consider hardening the management interface by restricting access to trusted networks or VPNs.
- Maintain an up‑to‑date inventory of exposed management interfaces and conduct regular penetration tests.
GreyNoise is publishing the signal, not predicting a CVE.
Related vulnerabilities
Check Point Products Hit by Remote Code Execution Vulnerability (CVE‑2026‑91843)
A newly disclosed flaw in Check Point’s Log and Security Management servers allows attackers to trigger remote code execution by exploiting a malformed username field. Affected releases span R81.20 through R82.20 across Log, Multi‑Domain Log, Security Management, and Multi‑Domain Security Management servers. Check Point advises scanning SmartConsole logs for the pattern "Administrator failed to log in: Username too long" and applying the vendor’s patch ASAP.
Read briefing
CVE-2026-0308: Stored XSS Vulnerability Discovered in PAN-OS Web Interface
A low-severity stored cross-site scripting flaw in Palo Alto Networks PAN-OS allows authenticated administrative users to inject and execute malicious JavaScript via the web management interface. Sysadmins managing PA-Series, VM-Series, and Panorama hardware or virtual appliances should review affected versions and apply vendor-supplied patches.
Read briefing
SAP Exposes Critical Kernel & Message Server Flaws: CVE-2026-44756 & CVE-2026-58240
SAP’s September Security Patch Day revealed two critical vulnerabilities that can be exploited remotely without authentication. The memory‑corruption flaw in SAP Extended Passport (OVERPASS, CVE‑2026‑44756) and the missing‑auth bug in NetWeaver Message Server (S4GET, CVE‑2026‑58240) both allow attackers to run arbitrary OS commands as the SAP installation user, risking full system takeover. Immediate application of SAP Security Notes 3747649 and 3759472 is mandatory.
Read briefing
Microsoft September 2026 Patch Tuesday: 964 CVEs, Including Two Zero-Day Exploits (CVE-2026-81963, CVE-2026-85880)
Microsoft released its largest Patch Tuesday to date, addressing 964 CVEs—104 critical and 860 important—including two zero‑day vulnerabilities exploited in the wild. Defenders must prioritize applying updates to affected components such as .NET, Active Directory services, Azure services, Office, and Windows kernel drivers, and verify system integrity.
Read briefing