SonicWall patched a pre-authentication SSRF (CVE-2026-102255, CVSS 10.0) in its SMA 1000 appliances on 6 October 2026; since 8 October, researchers have logged 135 exploitation attempts. If you run an internet-facing SMA 1000, apply hotfix 12.4.3-03670 or 12.5.0-03082 and hunt for web shells.
On September 1, 2026, SonicWall disclosed two flaws in the SMA 1000 line — a pre-authentication SSRF (CVE-2026-83548, CVSS 10) and an OS command injection (CVE-2026-83549) — already chained in the wild to reach remote code execution without credentials. Apply the hotfix now, and if compromise is confirmed, re-image the appliance instead of patching over the intrusion.
On August 19, 2026, CISA added CVE-2026-64849, an unauthenticated SSRF in MLflow, to its Known Exploited Vulnerabilities catalog. Any exposed MLflow tracking server should move to 3.15.0 and drop unused webhooks before the September 2, 2026 deadline.
