SonicWall's CVSS 10.0 SSRF chains into command execution on remote access appliances, and JFrog Artifactory hands unauthenticated attackers admin under default configuration. Reverse shells and miners are already landing.
Perspective Coverage
4 publishers
- Builder
- Builder 14%
- Operator
- Operator 72%
- Investor
- Investor 14%
Reality
- Evidence70
- Adoption
- Not scored
- Hype gap+10
- Incentives35
- Confidence68
buildOne report1 publisher Chaining a 10.0 portal SSRF to a 7.8 console injection gets OS execution on SonicWall's SMA1000
SonicWall confirmed both SMA1000 flaws were exploited before disclosure, and CISA gave federal agencies three days to remediate. The lower-scored console bug is the step that reaches the operating system.
Reality
- Evidence55
- Adoption60
- Hype gap+8
- Incentives35
- Confidence48
buildOne report1 publisher CISA gave federal SonicWall SMA 1000 operators three days to patch a pre-auth SSRF
SonicWall shipped fixed builds on the day the two flaws were disclosed, so the September 5 deadline tested patch cadence. One measurement service's product fingerprint finds seven SMA appliances; a certificate match on the vendor name finds 2,295,225.
Reality
- Evidence55
- Adoption30
- Hype gap+12
- Incentives60
- Confidence48
Metasploit packages the SonicWall SMA1000 root chain into one module
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality
- Evidence64
- Adoption55
- Hype gap+12
- Incentives74
- Confidence62
buildOne report1 publisher CISA's exploited-vulnerability catalog now reaches the LLM gateway
Seven entries went into CISA's known-exploited catalog on 2 September. The 5 September fix date covers four of the six products named, and the two AI-stack entries are the ones most teams cannot locate in a dependency graph.
Reality
- Evidence58
- Adoption34
- Hype gap+15
- Incentives30
- Confidence56