DanSec

Vendor

SonicWall

In 56 briefs, most recently 4 November 2026. RSS for this tag

Learn more: Vulnerabilities (NVD) ↗

Known exploited (CISA KEV)

19 SonicWall vulnerabilities are on CISA's list of vulnerabilities exploited in the wild, 13 of them used in ransomware campaigns. Most recent:

Coverage in DanSec Daily

  1. Binance $6.34B theft by North Korean actors, Beget cloud wipe, and a cPGuard supply chain backdoor.
  2. Danfoss-targeted French supermarket fridge sabotage, Yandex data center drone strikes, and Ledger spy-chip wallets.
  3. Ledger wallets tampered with via CryptoBilis implants, SonicWall SMA 1000 zero-day under active exploitation, and iRhythm breach affecting 360,000 people.
  4. ASOS customer data theft, the FakeGit GitHub malware campaign with 17,000+ repos, and Flax Typhoon disruption by the FBI, plus new exploited flaws.
  5. The ASOS breach, Google domain hijacking via .gh/.sl/.as registries, FortiBleed attacks on Fortinet FortiGate, and Atlassian CVE-2026-21589 exploitation.
  6. ASOS data breach, actively exploited Atlassian Data Center flaw, and FortiBleed Fortinet credential harvesting.
  7. Softaculous BGP hijack delivers malicious Virtualizor update; Dropbox breached via Lenovo ID flaw; 153M US/Canadian driver's license scans for sale on dark web.
  8. Aesto Health breach exposes 9.5M patients; SonicWall SMA 1000 zero-days exploited; Sality botnet dismantled by DOJ and partners.
  9. Microsoft August Patch Tuesday zero-days, Cisco ASA/FTD exploitation, Mozilla signing key exposure, and Gunra ransomware warnings.
  10. Polish CHP plant hacked via private cellular APN, LexisNexis and Valve/CEVA breaches, and actively exploited Progress Kemp LoadMaster flaw.
  11. The PNLD police data leak, N-able N-central CVE-2026-18577 exploitation, and INC Ransomware's SonicWall SMA 1000 attacks, plus Midnight Blizzard and DOUBLECUP …
  12. Hugging Face breach by an autonomous AI agent, Estée Lauder and EY data breaches, and actively exploited ServiceNow and SonicWall zero-days.
  13. Hugging Face breach tied to an autonomous AI agent, SonicWall SMA 1000 zero-days giving root access, and WP2Shell WordPress flaws exploited in the wild.
  14. Abbott's Exact Sciences breach, WordPress Core critical RCE flaws, and SonicWall SMA zero-days exploited for root access by threat actors.
  15. SonicWall SMA 1000 zero-days, Microsoft's record 622-flaw Patch Tuesday and nearly 300 fake GitHub infostealer repos.
  16. GitHub breach via a compromised Nx Console extension, Microsoft's takedown of the Fox Tempest malware-signing service, and SonicWall SSL-VPN MFA bypasses in …
  17. Roblox credential theft via fake game enhancements, an actively exploited cPanel zero-day, and the Mini Shai-Hulud SAP npm supply chain attack.
  18. Eurail breach exposing 300,000+ passport records, ChipSoft ransomware shutdown, and Smart Slider 3 Pro backdoored update supply chain attack.
  19. ManoMano breach hits 38M customers, Cisco SD-WAN zero-day CVE-2026-20127 exploited for three years, and US sanctions on exploit broker Operation Zero.
  20. UNC2814 espionage hit 53 orgs in 42 countries; Cisco SD-WAN flaw CVE-2026-20127 drew a CISA emergency directive; CarGurus breach hits 12M users.
  21. The Match Group breach, SonicWall-linked ransomware hitting US banks and credit unions, and actively exploited Ivanti EPMM zero-days.
  22. IDHS exposing ~700,000 residents' health data, a VMware ESXi zero-day exploited via SonicWall VPN, and Trend Micro Apex Central RCE patches.
  23. WhatsApp worm spreading Astaroth in Brazil, Kimwolf botnet infecting 2M+ Android TV boxes, and HPE OneView CVE-2025-37164 under active exploitation.
  24. Ferry malware arrests in France, E-Note crypto exchange seizure, HPE OneView CVE-2025-37164 RCE, and Kimsuky's $2B crypto theft in 2025.
  25. LKQ Oracle EBS breach, Cisco AsyncOS zero-day CVE-2025-20393 exploited by China-linked APT, and Kimwolf botnet hijacking 1.8M Android devices for DDoS.
  26. React2Shell RCE exploited in breaches at 30 organisations, Kohler smart toilet camera encryption flaws, and 30+ AI IDE vulnerabilities.
  27. The Salesforce Gainsight breaches by ShinyHunters, the CrowdStrike insider leak, and the actively exploited Oracle Identity Manager flaw (CVE-2025-61757).
  28. Salesforce OAuth data access via Gainsight, Italy's FS Italiane breach through Almaviva, and Operation WrtHug compromising 50,000+ Asus routers.
  29. Logitech and Washington Post breaches tied to Clop's Oracle E-Business Suite attacks, plus Fortinet FortiWeb zero-day exploited and added to CISA KEV.
  30. The SonicWall cloud backup breach, Sandworm's wiper attacks on Ukraine, Cisco UCCX patches (CVE-2025-20333), and a $128M Balancer DeFi exploit.
  31. Covers SonicWall firewall config breach by state-sponsored actors, Balancer V2 $128M crypto theft, and actively exploited CentOS Web Panel RCE flaw from CISA.
  32. SimonMed Imaging breach by Medusa, Oracle EBS zero-day hitting Harvard and Clop, and Salesforce-linked data leaks by extortion groups.
  33. SonicWall SSL VPN compromises across 100+ environments, Oracle EBS zero-day malware attacks, and FBI seizure of BreachForums domains tied to ShinyHunters.
  34. Oracle EBS zero-day exploited by CL0P, SonicWall cloud backup breach exposing firewall configs, and Discord ID photo leak of 70,000 users.
  35. Harrods and Jaguar Land Rover breaches, Asahi's cyberattack, and Akira ransomware exploiting SonicWall VPNs.
  36. Harrods data breach and arrests tied to retail cyberattacks, plus Akira ransomware bypassing MFA on SonicWall SSL VPNs and an EU probe into SAP.
  37. Boyd Gaming breach, GeoServer flaw (CVE-2024-36401) hitting a US federal agency, and RTX ransomware disrupting European airports via Collins Aerospace.
  38. Boyd Gaming data breach, Jaguar Land Rover production shutdown, and fake Malwarebytes and LastPass installers on GitHub targeting Mac users.
  39. SonicWall cloud backup breach, Tiffany & Co. data theft and BianLian-linked Medical Associates of Brevard breach affecting nearly 250,000 people.
  40. Salesforce data theft by ShinyHunters via Salesloft Drift tokens, Shai-Hulud NPM supply chain worm, and Chrome zero-day CVE-2025-10585.
  41. LNER breach, INC ransomware attack on Panama's finance ministry, and a critical SonicWall SSLVPN flaw (CVE-2024-40766) exploited by Akira ransomware.
  42. The Bouygues Telecom breach of 6.4 million customers, the Salesforce vishing campaign tied to ShinyHunters, and the CISA-mandated patch for Exchange …
  43. Pandora and Cisco data breaches, Android and Adobe AEM zero-days, and SonicWall firewall attacks by ransomware gangs in this August 2025 brief.
  44. Chanel and Northwest Radiologists breaches, Akira's suspected SonicWall zero-day, and SharePoint exploits hitting 148 organisations.
  45. Akira ransomware exploiting SonicWall SSL VPN zero-days, the Pi-hole GiveWP breach, and Secret Blizzard AitM attacks on Moscow embassies.
  46. BlackSuit ransomware sites seized, Toptal GitHub breach poisons npm packages, and ToolShell SharePoint flaws hit 400+ servers.
  47. Co-op's 6.5M member data theft, UNFI's up to $400M sales hit and Louis Vuitton breaches tied to ShinyHunters.
  48. Citrix NetScaler 'CitrixBleed 2' exploitation, Cyber Fattah's leak of 2024 Saudi Games data, and arrests of BreachForums operators in France.
  49. Nucor's data-theft breach, a trojanized SonicWall NetExtender VPN client, Microsoft Exchange login-page injections, and APT28 Signal-based malware campaigns in …
  50. The Coinbase insider data breach and extortion attempt, SAP NetWeaver exploitation by BianLian and RansomExx, and Samsung MagicINFO Mirai attacks.
  51. Pearson breach, Insight Partners data theft, and Toronto school district ransom, plus SonicWall and Cisco flaws and Qilin ransomware activity.
  52. Langflow and Samsung MagicINFO RCE exploitation, GeoVision devices feeding Mirai botnets, and the UK Legal Aid Agency incident.
  53. SonicWall SMA100 exploitation, Co-op cyberattack disruption and Ascension healthcare data breach.
  54. SK Telecom's USIM breach and SIM replacements, APT28's attribution by France, and the AirBorne AirPlay zero-click RCE flaws.
  55. SonicWall SMA VPN devices under active attack, Apple zero-days in targeted spyware attacks, and Smishing Triad toll SMS phishing in US and UK.
  56. SonicWall SMA exploitation, Apple iOS zero-days, a Fortinet symlink backdoor on 16,000+ devices, and the CrazyHunter ransomware targeting Taiwan.