# SonicWall SonicOS Management Interface Scanning Spike (May 2026) Echoing Pre-Disclosure Pattern of CVE-2026-0400

> GreyNoise observed a surge in scanning against SonicWall SonicOS management interfaces from May 9-18, 2026, peaking at approximately 597,000 sessions on May 12 (roughly 46x the typical daily volume over the prior 30 days). The pattern resembles scanning spikes that preceded CVE-2026-0400 disclosure on February 24, 2026; exploitation is not confirmed and the spike is framed as a potential early warning signal.

- **Published:** 2026-10-29T23:46:37Z
- **Last reviewed:** 2026-10-29T23:46:37Z
- **Canonical:** https://intel.threadlinqs.com/threat/TL-2026-4780
- **ID:** TL-2026-4780
- **Severity:** HIGH
- **Category:** VULNERABILITY
- **Status:** ACTIVE
- **Detections:** 9 · **IOCs:** 7 (full data via the Threadlinqs MCP server — Purple tier)
- **CVEs:** CVE-2026-0400

## Description

GreyNoise reported (blog dated 2026-05-21) a sharp elevation in its 'SonicWall SonicOS API Scanner' tag between 2026-05-09 and 2026-05-18. The peak was approximately 597,000 sessions on 2026-05-12, about 46x the typical daily volume for that tag over the preceding 30 days. Traffic overwhelmingly targeted ports 80 and 8080, which expose SonicOS management interfaces and API endpoints. Roughly 99% of requests carried a single user-agent, Chrome 119 on Linux x86_64. GreyNoise states this is the same fingerprint that dominated the January-February 2026 SonicWall scanning (94.5% of Q1 traffic, per its 'Ten Days Before Zero' research), which suggests the same threat actor infrastructure may be involved.

About 56% of sessions came from Netherlands-announced networks and about 44% from Ukraine-announced networks, so these two countries account for over 99% of observed sessions. A single ASN, AS211736, carries roughly half of the volume. Public registry data lists AS211736 as FDN3 / FOP Dmytro Nedilskyi, a Ukrainian sole proprietorship, and the French firm Intrinsec has linked it to bulletproof hosting operations in other reporting. This is context about the ASN, not a confirmed attribution of this campaign. Most source IPs are classified as Suspicious by GreyNoise. The public sources reviewed list no individual IP addresses.

The historical analogue is CVE-2026-0400. Activity on the same tag spiked on 2026-01-18, 2026-01-30 and 2026-02-14, which was 37, 25 and 10 days before the 2026-02-24 disclosure of CVE-2026-0400 (SonicWall PSIRT SNWLID-2026-0001). GreyNoise's 'Ten Days Before Zero' research reports that elevations of this kind have preceded new SonicWall vulnerability disclosures by a median of about 11 days. CVE-2026-0400 is a post-authentication format string flaw (CWE-134) in SonicOS that lets a remote authenticated attacker crash the firewall (denial of service). It is rated CVSS 4.9 (Medium) and affects SonicOS 7.0.1-5169 and older and 7.3.1-7013 and older, with TZ-series models listed and a fix in later builds. GreyNoise's separate 'At The Edge Clear' report for May 11-18, 2026 notes SonicWall sessions rebounding, with coordinated credential attacks and management API scanning at roughly equal ratios, and SonicWall accounting for 72.2% of enterprise VPN targeting that week.

This is reconnaissance, not confirmed exploitation. No new CVE and no CVSS score were assigned for the spike, so severity is set to HIGH as a precursor early-warning signal. The pattern is correlational and does not guarantee a forthcoming disclosure. Defenders should restrict SonicOS management and API access to known admin ranges, remove public exposure of management interfaces, enforce MFA on SSL VPN accounts, audit for unauthorized administrative accounts created since 2026-05-01, deploy dynamic IP blocklists, monitor the SonicWall PSIRT feed, and be prepared to patch within 24 hours.

## MITRE ATT&CK

- T1595 Active Scanning
- T1595.002 Active Scanning: Vulnerability Scanning
- T1583 Acquire Infrastructure
- T1190 Exploit Public-Facing Application
- T1133 External Remote Services
- T1110 Brute Force
- T1078 Valid Accounts
- T1499.004 Endpoint Denial of Service: Application or System Exploitation

## Sources

- [A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400](https://www.greynoise.io/blog/sonicwall-scanning-spike-echoes-pattern-preceded-cve-2026-0400)
- [GreyNoise At The Edge Clear: May 11 - 18, 2026](https://www.greynoise.io/resources/at-the-edge-clear-051826)
- [Hackers Actively Scan SonicWall Firewall Interfaces - 597,000 Sessions Observed](https://cybersecuritynews.com/hackers-scan-sonicwall-firewall-interfaces/)
- [NVD - CVE-2026-0400](https://nvd.nist.gov/vuln/detail/cve-2026-0400)
- [SonicWall PSIRT SNWLID-2026-0001 (CVE-2026-0400)](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001)
- [Tenable - SonicWALL SonicOS Use of Externally-Controlled Format String (CVE-2026-0400)](https://www.tenable.com/cve/CVE-2026-0400)
- [Active Reconnaissance Campaign Targets SonicWall Firewalls Through Commercial Proxy Infrastructure](https://www.greynoise.io/blog/active-reconnaissance-campaign-targets-sonicwall-firewalls-through-commercial-proxy-infrastructure)

## Full data

Detection queries (Splunk SPL / Microsoft KQL / Sigma) and IOC values require the Threadlinqs MCP server (Purple tier): https://intel.threadlinqs.com/mcp

Canonical: https://intel.threadlinqs.com/threat/TL-2026-4780