A CVSS 10.0 SonicWall flaw is being exploited right now
Key takeaways
- A maximum severity SonicWall vulnerability is under active exploitation and has been added to CISA's Known Exploited Vulnerabilities catalogue.
- CISA added six actively exploited flaws in the same batch.
- Edge security appliances are the most attacked class of device on the internet, because they sit outside everything else.
- If you cannot patch immediately, restrict management access and assume the device may already be touched.
A SonicWall vulnerability with the maximum CVSS score of 10.0 is being exploited in the wild, and the US Cybersecurity and Infrastructure Security Agency (CISA) has added it to its Known Exploited Vulnerabilities (KEV) catalogue. It arrived as part of a batch of six actively attacked flaws, according to CISA's catalogue and The Hacker News, which reported the additions.
A CVSS 10.0 rating is the top of the scale, and it is rarer than the noise around vulnerability scoring suggests. It means the flaw is remotely reachable, needs no authentication, has low complexity and gives full compromise on success. That combination is now sitting in a SonicWall product, and somebody is using it.
What does a CVSS 10.0 score actually mean?
CVSS, the Common Vulnerability Scoring System, rates the technical severity of a flaw on a scale from 0 to 10. Scores in the top band are labelled critical, but 10.0 is reserved for flaws where every factor points the worst way. An attacker can reach the device over the network, does not need a login, does not need to trick a user into clicking anything, and ends up with complete control.
The score is a theoretical statement about how bad something could be. It says nothing about whether anyone is actually exploiting it. That is why the KEV listing matters more than the number alone.
What is the CISA KEV catalogue and why does a listing matter?
The KEV catalogue is a public list, maintained by CISA, of vulnerabilities that have been observed being exploited in real attacks. A KEV entry is a factual statement that somebody is doing it. For US federal agencies, a listing also starts a clock for remediation, and many private organisations use it as a priority queue for the same reason.
If you have never used it, our report on ten exploited flaws in seven days shows how quickly the list can grow. The SonicWall flaw arrived in a batch, and batches are now routine. We covered a similar run of CISA KEV additions in August 2026, including a 9.8 in macOS Screen Sharing.
| Measure | What it tells you | What it does not tell you |
|---|---|---|
| CVSS score | How severe the flaw could be in theory | Whether anyone is attacking it |
| KEV listing | Exploitation has been observed in the wild | How likely your own device is to be hit |
| Vendor advisory | Which builds are fixed | Whether you were already compromised |
Why do edge appliances keep ending up here?
Firewalls, VPN concentrators and secure access gateways share an awkward property. They are deliberately exposed to the internet, they terminate encrypted traffic, and they usually sit outside the reach of the endpoint agents and network monitoring that watch everything else. Compromise one and you are inside, authenticated, and largely unobserved.
That is why this class of device has dominated the KEV catalogue for three years running. It is not that the vendors are uniquely careless. The attack surface is small, valuable and permanently lit up, so attackers concentrate their effort there.
SonicWall is not alone. Cisco's identity gatekeeper had its own maximum severity hole, covered in our piece on the Cisco ISE zero-day, and the same pattern of internet-facing infrastructure under attack runs through most of the recent KEV additions.
What should you do today?
The order matters more than the list.
- Patch to the fixed firmware. Vendor advisories for edge kit are usually explicit about the minimum safe build, so match the exact version rather than assuming a recent update covers it.
- If you cannot patch this week, take the management interface off the public internet. Most compromises of this shape start at an admin portal that never needed to be reachable.
- Rotate credentials and any VPN certificates or pre-shared keys on affected devices. Assume anything stored on the appliance was readable.
- Check logs for configuration changes, new local accounts and unexpected VPN sessions going back several weeks, not several days. Exploitation usually predates disclosure.
- Terminate live sessions after patching. Patching does not evict an attacker who already holds a session token.
Why rotate credentials after patching?
A patch closes the door, but it does not tell you who walked through it beforehand. An appliance stores administrator passwords, VPN pre-shared keys and certificates, and often directory service credentials used to authenticate users. If an attacker had full control, all of that should be treated as copied.
Session tokens are the other trap. A token issued before the patch can remain valid afterwards, so an attacker who already holds one keeps their access until the session is ended. Killing live sessions is a cheap step that is easy to forget.
How do you check whether a device was already touched?
Look for changes nobody on your team made. New local administrator accounts, altered firewall rules, added VPN users and configuration exports are the usual signs. Compare the running configuration against a known good backup if you have one.
Also check where the device was reachable from. If the management portal faced the internet, assume it was scanned, because mass scanning for newly listed flaws begins quickly. Where the logs are thin, treat the appliance as suspect and consider rebuilding it from a clean image rather than trusting it.
Is a monthly patch cycle still good enough?
Six KEV additions in one batch is not unusual any more. What is changing is the speed at which proof of concept code turns into broad scanning, and that trend is being pushed along by tooling that writes the exploit for you. The practical consequence is that a monthly patch cycle is no longer a defensible posture for anything with a public IP address.
CISA has been tightening its own expectations too, and our report on the three day patch window shows how short the margin has become for exposed systems.
A workable rule for small teams is that internet-facing kit gets patched on a separate, faster track from everything else, and the KEV catalogue sets that track's queue. It is a free, government-maintained list of things that are definitely being attacked. Very few security inputs are that clean.
The quiet detail here is timing. By the time a flaw reaches KEV, the exploitation has already been observed in the wild by somebody. You are not getting ahead of it. You are catching up, and how fast you catch up is the whole game.
Key takeaways
- The SonicWall flaw has a CVSS score of 10.0, meaning it is remotely reachable, needs no authentication, has low complexity and gives full compromise on success.
- CISA added the SonicWall flaw to the Known Exploited Vulnerabilities catalogue as part of a batch of six actively attacked issues.
- Firewalls, VPN concentrators and secure access gateways are prime targets because they are deliberately exposed to the internet and terminate encrypted traffic.
- If you cannot patch immediately, take the management interface off the public internet and assume the device may already be touched.
- The KEV catalogue is a free, government-maintained list of flaws that are definitely being attacked, and it should set the patching queue for internet-facing kit.
