Threat reportVulnerabilityTL-2026-4780
SonicWall SonicOS Management Interface Scanning Spike (May 2026) Echoing Pre-Disclosure Pattern of CVE-2026-0400
SonicWall SonicOS Management Interface Scanning Spike (May (TL-2026-4780) is a high-severity software vulnerability, first published 2026-10-29. It has no confirmed attribution, affects SonicWall SonicOS (management interface / API), references 1 CVE (CVE-2026-0400), maps to 8 MITRE ATT&CK techniques (T1078, T1110, T1133), and is covered by 9 detection rules and 7 indicators of compromise.
- Severity
- HIGHAssessed severity
- CVEs
- 1Referenced vulnerabilities
- Techniques
- 8MITRE ATT&CK
- Actors
- 0Not attributed
- Detection rules
- 9SPL · KQL · Sigma
- IOCs
- 7Indicators of compromise
Key facts for TL-2026-4780
- Threat ID
- TL-2026-4780
- Severity
- HIGH
- Status
- ACTIVE
- Category
- VULNERABILITY
- First published
- Last reviewed
- Attribution confidence
- LOW
- Motivation
- UNKNOWN
- Target sectors
- technology, government administration, finance, health, manufacturing
- Target regions
- Global
- Detection rules
- 9
- Indicators of compromise
- 7
How SonicWall SonicOS Management Interface Scanning Spike (May works
GreyNoise observed a surge in scanning against SonicWall SonicOS management interfaces from May 9-18, 2026, peaking at approximately 597,000 sessions on May 12 (roughly 46x the typical daily volume over the prior 30 days). The pattern resembles scanning spikes that preceded CVE-2026-0400 disclosure on February 24, 2026; exploitation is not confirmed and the spike is framed as a potential early warning signal.
GreyNoise reported (blog dated 2026-05-21) a sharp elevation in its 'SonicWall SonicOS API Scanner' tag between 2026-05-09 and 2026-05-18. The peak was approximately 597,000 sessions on 2026-05-12, about 46x the typical daily volume for that tag over the preceding 30 days. Traffic overwhelmingly targeted ports 80 and 8080, which expose SonicOS management interfaces and API endpoints. Roughly 99% of requests carried a single user-agent, Chrome 119 on Linux x86_64. GreyNoise states this is the same fingerprint that dominated the January-February 2026 SonicWall scanning (94.5% of Q1 traffic, per its 'Ten Days Before Zero' research), which suggests the same threat actor infrastructure may be involved.
About 56% of sessions came from Netherlands-announced networks and about 44% from Ukraine-announced networks, so these two countries account for over 99% of observed sessions. A single ASN, AS211736, carries roughly half of the volume. Public registry data lists AS211736 as FDN3 / FOP Dmytro Nedilskyi, a Ukrainian sole proprietorship, and the French firm Intrinsec has linked it to bulletproof hosting operations in other reporting. This is context about the ASN, not a confirmed attribution of this campaign. Most source IPs are classified as Suspicious by GreyNoise. The public sources reviewed list no individual IP addresses.
The historical analogue is CVE-2026-0400. Activity on the same tag spiked on 2026-01-18, 2026-01-30 and 2026-02-14, which was 37, 25 and 10 days before the 2026-02-24 disclosure of CVE-2026-0400 (SonicWall PSIRT SNWLID-2026-0001). GreyNoise's 'Ten Days Before Zero' research reports that elevations of this kind have preceded new SonicWall vulnerability disclosures by a median of about 11 days. CVE-2026-0400 is a post-authentication format string flaw (CWE-134) in SonicOS that lets a remote authenticated attacker crash the firewall (denial of service). It is rated CVSS 4.9 (Medium) and affects SonicOS 7.0.1-5169 and older and 7.3.1-7013 and older, with TZ-series models listed and a fix in later builds. GreyNoise's separate 'At The Edge Clear' report for May 11-18, 2026 notes SonicWall sessions rebounding, with coordinated credential attacks and management API scanning at roughly equal ratios, and SonicWall accounting for 72.2% of enterprise VPN targeting that week.
This is reconnaissance, not confirmed exploitation. No new CVE and no CVSS score were assigned for the spike, so severity is set to HIGH as a precursor early-warning signal. The pattern is correlational and does not guarantee a forthcoming disclosure. Defenders should restrict SonicOS management and API access to known admin ranges, remove public exposure of management interfaces, enforce MFA on SSL VPN accounts, audit for unauthorized administrative accounts created since 2026-05-01, deploy dynamic IP blocklists, monitor the SonicWall PSIRT feed, and be prepared to patch within 24 hours.
MITRE ATT&CK techniques used in TL-2026-4780
Defense Evasion
Credential Access
Initial Access
T1133 External Remote Services; T1190 Exploit Public-Facing Application
Impact
T1499.004 Endpoint Denial of Service: Application or System Exploitation
Resource Development
Reconnaissance
T1595 Active Scanning; T1595.002 Active Scanning: Vulnerability Scanning
Affected products and versions in SonicWall SonicOS Management Interface Scanning Spike (May
- SonicWall — SonicOS (management interface / API)
Vulnerable versions: 7.0.1-5169 and older (CVE-2026-0400); 7.3.1-7013 and older (CVE-2026-0400)
Fixed in: See SonicWall PSIRT SNWLID-2026-0001
Remediation for SonicWall SonicOS Management Interface Scanning Spike (May
Patches
- Apply SonicWall fixes per advisory SNWLID-2026-0001 for CVE-2026-0400 (SonicOS builds newer than 7.0.1-5169 and 7.3.1-7013)
Immediate actions
- Restrict SonicOS management API and SSL VPN access to known administrator IP ranges
- Remove public internet exposure of firewall management interfaces on ports 80 and 8080
- Enforce MFA on all SSL VPN accounts
- Audit for unauthorized administrative accounts created since 2026-05-01
- Deploy dynamic IP blocklists for sources classified as suspicious (including AS211736 traffic)
Workarounds
- Disable WAN-side HTTP/HTTPS management and restrict access to a management VPN or allowlist
Longer-term hardening
- Monitor the SonicWall PSIRT advisory feed and keep a 24-hour patch-response capability ready
- Increase log retention and alerting for unusual management-plane and outbound activity
- Track GreyNoise 'SonicWall SonicOS API Scanner' tag spikes as an early-warning signal
CVEs associated with SonicWall SonicOS Management Interface Scanning Spike (May
Weaknesses (CWE) in SonicWall SonicOS Management Interface Scanning Spike (May
Timeline of SonicWall SonicOS Management Interface Scanning Spike (May
- First Q1 spike on GreyNoise 'SonicWall SonicOS API Scanner' tag, 37 days before CVE-2026-0400 disclosure
- Second Q1 spike on the same tag, 25 days before CVE-2026-0400 disclosure
- Third Q1 spike on the same tag, 10 days before CVE-2026-0400 disclosure
- CVE-2026-0400 (post-auth format string DoS in SonicOS, CVSS 4.9) published; SonicWall PSIRT SNWLID-2026-0001
- Scanning of SonicOS management interfaces begins to elevate
- Peak of about 597,000 sessions, roughly 46x the 30-day daily baseline
- Elevated scanning window ends; GreyNoise 'At The Edge Clear' covers May 11-18 and notes coordinated credential attacks alongside API scanning
- GreyNoise publishes analysis framing the spike as a potential pre-disclosure early-warning signal; exploitation not confirmed
Sources cited for SonicWall SonicOS Management Interface Scanning Spike (May
- A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400
- GreyNoise At The Edge Clear: May 11 - 18, 2026
- Hackers Actively Scan SonicWall Firewall Interfaces - 597,000 Sessions Observed
- NVD - CVE-2026-0400
- SonicWall PSIRT SNWLID-2026-0001 (CVE-2026-0400)
- Tenable - SonicWALL SonicOS Use of Externally-Controlled Format String (CVE-2026-0400)
- Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure
Detection coverage for TL-2026-4780
As of 2026-10-29, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-4780 across Splunk SPL, Microsoft KQL and Sigma, covering 7 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.