Critical SonicWall SMA1000 flaw targeted after disclosure

Reporting cites 135 exploitation attempts against a CVSS 10 pre-authentication SonicWall SMA1000 flaw shortly after disclosure, reinforced by honeypot observations and prior appliance compromises exposing credentials, sessions, and MFA seeds. Confirmed victims and post-exploitation activity remain unclear; defenders should patch or mitigate, preserve evidence, review logs, investigate unauthorized internal requests, and rotate potentially exposed authentication material.