CISA: SONICWALL FLAWS NOW UNDER ACTIVE RANSOMWARE ATTACK

The two flaws affect SonicWall's SMA1000 Secure Mobile Access appliances. The more severe vulnerability is a maximum-severity SSRF (server-side request forgery) issue that allows attackers to bypass security controls and access internal systems. Both vulnerabilities have been patched by SonicWall, but the company's advisory indicates that exploitation in the wild has already begun. The timing of the public disclosure and active attacks is typical for ransomware operations, which quickly weaponize newly disclosed flaws before widespread patching occurs. CISA recommends that organizations running SonicWall SMA1000 devices apply available patches immediately. The agency also suggests reviewing network logs for signs of exploitation and isolating affected devices if compromise is suspected. SonicWall has not disclosed the number of affected customers or specific details about the ransomware groups involved in the attacks.