A New Sonic Wall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400

Summary: GreyNoise recorded a spike in scanning of SonicWall SonicOS management interfaces between May 9 and May 18, 2026, peaking on May 12 at approximately 597,000 sessions - the largest single-day total on its SonicWall SonicOS API Scanner tag in 90 days and roughly 46 times the typical daily volume of the prior 30 days. Three earlier spikes on the same tag, on January 18, January 30, and February 14, came 37, 25, and 10 days before the February 24 disclosure of CVE-2026-0400, and GreyNoise describes the current activity as a possible early warning rather than a prediction.
Key Takeaway: The prior sequence gave as little as 10 days between a scanning spike and a SonicWall CVE disclosure, and GreyNoise states plainly that the May spike could be the first of a multi-event sequence, a single event before a disclosure, or unrelated activity - so the exposure window is real but the timing is not knowable in advance.

Read the original at GreyNoise Blog ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-0400
Related: Attackers Exploit UnrealIRCd Flaw That Enables Server-Level Command Injection Cyber Risks · Nov 14, 2026
U.S. CISA adds Check Point and UnrealIRCd flaws to its Known Exploited Vulnerabilities catalog Cyber Risks · Nov 14, 2026
PostgreSQL Patches 52 Flaws, Including 22-Year-Old Bug Enabling Authenticated RCE Cyber Risks · Nov 13, 2026