CVE-2026-0400General(sonicwall / nsa_2700)

A scanning pattern similar to the one preceding CVE-2026-0400 in February is active again. May 12 saw the largest single-day session volume on this SonicWall tag in 90 days. 🔗https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400 #GreyNoise #ThreatIntel #SonicWall https://t.co/o6zmvUDzXm

New SonicWall scanning spike hits 597K sessions on May 12 — 46× normal volume with identical tooling from Netherlands/Ukraine infrastructure. Pattern mirrors the January-February sequence that preceded CVE-2026-0400. #DFIR_Radar https://t.co/fxkguusXI6

Something to watch (also shoutout to @GreyNoiseIO for always having great intel 🫶) https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400

Scanning spikes are often an early warning sign. When activity targeting SonicWall devices mirrors patterns seen before a known CVE, defenders should treat it as a signal to verify exposure, harden access, and increase monitoring before exploitation escalates. What organizations should prioritize now: - Identify all SonicWall devices and confirm firmware versions and exposure - Apply available patches, hotfixes, and vendor-recommended mitigations - Restrict management interfaces with VPN/Zero Trust, IP allowlisting, and MFA - Review logs for unusual scanning, failed authentication, suspicious admin activity, and configuration changes - Disable unused services and reduce internet-facing attack surface - Monitor for lateral movement or abnormal outbound traffic from edge devices 𝗩𝗶𝘀𝘁𝗲𝗺 𝗘𝗹𝗲𝘃𝗮𝘁𝗲 𝗽𝗼𝘄𝗲𝗿𝗲𝗱 𝗯𝘆 𝗩𝗶𝘀𝘁𝗲𝗺𝗦𝗲𝗰𝘂𝗿𝗲𝗣𝗿𝗼 helps organizations validate exposure, prioritize remediation, and strengthen edge security with vCISO-led strategy, continuous monitoring, and measurable risk reduction. Contact: sales@vistem.com | http://www.vistem.com?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer #Cybersecurity #SonicWall #ThreatIntel #VulnerabilityManagement #EdgeSecurity #NetworkSecurity #IncidentResponse #ZeroTrust #CyberResilience #VistemElevate #VistemSecurePro #VistemSolutions #SecurityCompliance https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400?utm_source=in_page&utm_medium=Vistem+Solutions%2C+Inc.&utm_campaign=publer

#threatreport #LowCompleteness A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400 | 22-05-2026 Source: https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400 Key details below ↓ 🎯Victims: Sonicwall users, Ssl vpn users 🌐Geo: Netherlands, Ukraine 🔓CVEs: CVE-2026-0400 \[[Vulners](https://vulners.com/cve/CVE-2026-0400)] - CVSS V3.1: *4.9*, - Vulners: Exploitation: Unknown Soft: - sonicwall sonicos (<7.3.2-7010) 🤖LLM extracted TTPs:` T1595 🧨IOCs: - IP: 5 💽Software: Slack, SonicOS, Chrome, Linux #threatreport: Recent observations by GreyNoise indicate a substantial increase in scanning activity targeting SonicWall SonicOS management interfaces between May 9 and May 18, 2026. The peak occurred on May 12, with around 597,000 sessions recorded, marking a staggering 46 times the usual daily volume for this tag. Such spikes have historically preceded the disclosure of vulnerabilities affecting SonicWall products. Notably, previous activity spikes occurred on January 18, January 30, and February 14, which all preceded the February 24 release of CVE-2026-0400. Analysis of the scanning activity shows that approximately 99% of the requests identified a singular browser user-agent—Chrome 119 on Linux x86_64—consistent with the patterns observed during the earlier spikes. This continuity suggests that the same tooling is being employed in the current wave of scanning. Regarding the origins of these sessions, about 56% come from networks in the Netherlands, and 44% from Ukraine, indicating a highly concentrated threat landscape, with a single Autonomous System Number (ASN) accounting for roughly half of all sessions. Importantly, many of the IP addresses involved have been classified as suspicious by GreyNoise. The specific services targeted during this spike are predominantly found on ports 80 and 8080 (HTTP), aligning with established tactics commonly employed in the reconnaissance phase of cyber attacks. In response to the potential threat this activity signifies, defenders are advised to take several precautionary measures. These include restricting access to the SonicOS management API and SSL VPN portal to known administrative IP ranges, which would mitigate the risk of unauthorized access. Public exposure of management interfaces should be eliminated alongside mandatory multi-factor authentication (MFA) for all SSL VPN accounts. Additionally, it is recommended to conduct audits of the SonicOS configuration to identify any new administrative accounts created since May 1, 2026, and to employ a dynamic IP blocklist at the network perimeter to further protect against potential exploitation.

A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400 https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400

CVE-2026-0399, CVE-2026-0400, CVE-2026-0401, CVE-2026-0402 SonicOS multiple post-authentication vulnerabilities https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001

CVE-2026-0400 A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall. https://www.cve.org/CVERecord?id=CVE-2026-0400