[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fMt_RN8wR02XWXGAIDH2XOmSrzWVirng3saBN-C8ESkE":3},{"article":4,"iocs":54,"watch_terms":69,"solutions":70,"lesson":164},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":31,"category":32,"article_tags":36},"1e0efe28-d8f9-429a-8d72-24a7bd2d37f9","Max severity SonicWall SMA1000 flaw now exploited in attacks","max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks-6dabc0","Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago. [...]","Attackers are actively exploiting a critical vulnerability, CVE-2026-102255, in SonicWall SMA1000 appliances shortly after a patch was released. The flaw affects the Appliance WorkPlace interface and allows unauthenticated remote attackers to issue requests on behalf of the appliance. This exploitation follows a pattern of previous vulnerabilities in SMA1000 devices, some of which have been linked to ransomware gangs by CISA.","SonicWall SMA1000 vulnerability (CVE-2026-102255) is being exploited in attacks.","https:\u002F\u002Fwww.bleepingcomputer.com\u002Fnews\u002Fsecurity\u002Fmax-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks\u002F","https:\u002F\u002Fwww.bleepstatic.com\u002Fcontent\u002Fhl-images\u002F2026\u002F10\u002F09\u002FSonicWall-headpic.jpg","2026-10-09T12:32:16+00:00","2026-10-09T14:00:22.983929+00:00",9,[17,20,23,26,29],{"name":18,"type":19},"SMA1000","product",{"name":21,"type":22},"SonicWall","vendor",{"name":24,"type":25},"ransomware gangs","threat_actor",{"name":27,"type":28},"VPN","technology",{"name":30,"type":19},"Appliance WorkPlace","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":31,"icon":33,"name":34,"slug":35},null,"Vulnerabilities","vulnerabilities",[37,42,47,49],{"category":38},{"id":39,"icon":33,"name":40,"slug":41},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":43},{"id":44,"icon":33,"name":45,"slug":46},"7d8b5ab8-ea0b-4ced-ae97-ec251b86993a","Ransomware","ransomware",{"category":48},{"id":31,"icon":33,"name":34,"slug":35},{"category":50},{"id":51,"icon":33,"name":52,"slug":53},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[55,59,62,64,67],{"type":56,"value":57,"context":58},"cve","CVE-2026-102255","Maximum severity vulnerability in SonicWall SMA1000 appliances.",{"type":56,"value":60,"context":61},"CVE-2026-15409","Previously exploited SMA1000 zero-day.",{"type":56,"value":63,"context":61},"CVE-2026-15410",{"type":56,"value":65,"context":66},"CVE-2026-83548","Previously chained zero-day in SMA1000 gateways.",{"type":56,"value":68,"context":66},"CVE-2026-83549",[21,18,30],{"controls":71,"vendors":158},[72,101,130],{"slug":73,"name":74,"problem":75,"products":76},"zero-trust-access","Zero trust network access (ZTNA)","Remote access no longer means exposing VPN appliances to the internet.",[77,85,93],{"vendor_slug":78,"vendor_name":79,"vendor_logo":80,"product_slug":81,"product_name":82,"url":83,"description":84},"zscaler","Zscaler","\u002Fvendor-logos\u002Fzscaler.png","zscaler-private-access","Zscaler Private Access","https:\u002F\u002Fwww.zscaler.com\u002Fproducts-and-solutions\u002Fzscaler-private-access","Zero trust access to private applications, replacing VPN.",{"vendor_slug":86,"vendor_name":87,"vendor_logo":88,"product_slug":89,"product_name":90,"url":91,"description":92},"netskope","Netskope","\u002Fvendor-logos\u002Fnetskope.png","netskope-private-access","Netskope Private Access","https:\u002F\u002Fwww.netskope.com\u002Fproducts\u002Fprivate-access","Zero trust access to private applications.",{"vendor_slug":94,"vendor_name":95,"vendor_logo":96,"product_slug":97,"product_name":98,"url":99,"description":100},"cloudflare","Cloudflare","\u002Fvendor-logos\u002Fcloudflare.png","cloudflare-access","Cloudflare Access","https:\u002F\u002Fwww.cloudflare.com\u002Fsase\u002Fproducts\u002Faccess\u002F","Zero trust access to internal applications without a VPN.",{"slug":102,"name":103,"problem":104,"products":105},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[106,114,122],{"vendor_slug":107,"vendor_name":108,"vendor_logo":109,"product_slug":110,"product_name":111,"url":112,"description":113},"rapid7","Rapid7","\u002Fvendor-logos\u002Frapid7.png","insightvm","Rapid7 Exposure Command (InsightVM)","https:\u002F\u002Fwww.rapid7.com\u002Fproducts\u002Finsightvm\u002F","Vulnerability scanning and risk-based prioritisation; InsightVM is now part of Exposure Command, alongside attack surface and cloud risk.",{"vendor_slug":115,"vendor_name":116,"vendor_logo":117,"product_slug":118,"product_name":119,"url":120,"description":121},"holm-security","Holm Security","\u002Fvendor-logos\u002Fholm-security.png","holm-security-platform","Holm Security Platform","https:\u002F\u002Fwww.holmsecurity.com\u002F","Vulnerability scanning of systems, web applications, cloud and the external attack surface, plus phishing simulation.",{"vendor_slug":123,"vendor_name":124,"vendor_logo":125,"product_slug":126,"product_name":127,"url":128,"description":129},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"slug":131,"name":132,"problem":133,"products":134},"patch-management","Automated patch management","Known holes get closed in days, not months.",[135,142,150],{"vendor_slug":136,"vendor_name":137,"vendor_logo":138,"product_slug":131,"product_name":139,"url":140,"description":141},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","Qualys Patch Management","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fpatch-management\u002F","Patch deployment for operating systems and third-party applications, linked to vulnerability findings.",{"vendor_slug":143,"vendor_name":144,"vendor_logo":145,"product_slug":146,"product_name":147,"url":148,"description":149},"action1","Action1","\u002Fvendor-logos\u002Faction1.png","action1-patch-management","Action1 Patch Management","https:\u002F\u002Fwww.action1.com\u002F","Cloud-native patch management for Windows, macOS and third-party applications.",{"vendor_slug":151,"vendor_name":152,"vendor_logo":153,"product_slug":154,"product_name":155,"url":156,"description":157},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",[159],{"slug":160,"name":21,"logo_path":161,"roles":162},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[163],"affected",{"slug":165,"title":166,"body":167,"framework_refs":168,"framework_notes":179},"critical-sonicwall-sma1000-flaw-actively-exploited-days-after-patch-release","Critical SonicWall SMA1000 Flaw Actively Exploited Days After Patch Release","A maximum-severity vulnerability in SonicWall SMA1000 appliances is being actively exploited in the wild shortly after a patch became available, highlighting the dangerously narrow window organizations have to remediate critical flaws in internet-facing devices. The flaw allows unauthenticated remote attackers to send arbitrary requests on behalf of the appliance, effectively enabling full compromise without any credentials. This follows a well-documented pattern of SMA1000 vulnerabilities being weaponized by ransomware groups, indicating these devices are high-value targets that threat actors monitor closely. Organizations that delay patching internet-facing remote access appliances even briefly face disproportionately high risk of breach.",[169,170,171,172,173,174,175,176,177,178],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev. 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","CISA Known Exploited Vulnerabilities (KEV) Catalog","ITIL Change Management: Emergency Change Procedures","ISO\u002FIEC 27001 A.12.6.1: Management of Technical Vulnerabilities",{}]