CVE detail
CVE-2026-0400
A post-authentication Format String vulnerability in SonicOS allows a remote attacker to crash a firewall.
Buzz score
Why this CVE is surfacing
This all-time snapshot uses the same composite formula as Trending across a 30-year evidence window, rather than a current rolling window.
Buzz score components · mention 20.8 · diversity 10.0 · KEV 0.0 · OTX 0.0 · PoC 0.0
Why it matters now
Mention timeline
- Total mentions
- 0
- within the 30d window
- Peak daily
- 0
- highest bucket
Evidence
Source links by recency
7 source links · newest first
A new SonicWall scanning surge mirrors the pattern that preceded CVE-2026-0400. GreyNoise details the activity and what defenders should watch.
vendorwww.greynoise.ioMay 21, 2026, 12:00 AMnsights The Internet Changes Before the Advisory Drops GreyNoise April 20, 2026 Before Cisco published its advisory for CVE-2026-20127 — a CVSS 10.0 zero-day cited in a Five Eyes joint warning — GreyNoise sensors had already observed eight distinct surges of Cisco-targeting activity. The earliest arrived 39 days before disclosure. Each one came closer
vendorwww.greynoise.ioApr 20, 2026, 12:00 AM- https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0001psirt.global.sonicwall.com
No excerpt available.
Vendor Advisorypsirt.global.sonicwall.comFeb 24, 2026, 3:21 PM - Active Ivanti Exploitation Traced to Single Bulletproof IP—Published IOC Lists Point ElsewhereGreyNoise
nvestigate for signs of compromise. For GreyNoise customers: An IOC package and executive situation report (SITREP) for CVE-2026-1281 have been delivered to your inbox. Check your email for the full package, including indicators, detection guidance, and a board-ready summary. The Vulnerability and Timeline CVE-2026-1281 is a CVSS 9.8 (v3.1) unauthen
vendorwww.greynoise.ioFeb 10, 2026, 12:00 AM elated content View all related articles Threat Signals A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400 GreyNoise May 21, 2026 Threat Signals Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet GreyNoise Apr 10, 2026 Threat Signals Ghost Fleet: Half of All New Scanning IPs Last Week Geoloca
vendorwww.greynoise.ioNov 19, 2025, 12:00 AMelated content View all related articles Threat Signals A New SonicWall Scanning Spike Echoes the Pattern That Preceded CVE-2026-0400 GreyNoise May 21, 2026 Threat Signals Just 21 IP Addresses Are Now Behind Nearly Half of All RDP Scanning on the Internet GreyNoise Apr 10, 2026 Threat Signals Ghost Fleet: Half of All New Scanning IPs Last Week Geoloca
vendorwww.greynoise.ioOct 20, 2025, 12:00 AM4 hours — representing the third-ever emergency directive since the agency’s founding. Both vulnerabilities, tracked as CVE-2025-20333 and CVE-2025-20362 , have been added to CISA’s Known Exploited Vulnerabilities (KEV) catalog. Resurgent Brute Force Attacks Against Cisco SSL VPNs After investigating activity against our Cisco profiles, GreyNoise ide
vendorwww.greynoise.ioSep 4, 2025, 12:00 AM
Exploit code
Public exploit repository references
Public PoC repositories are third-party, potentially unsafe artifacts. Treat their code as untrusted and use it only on authorized systems in an isolated, least-privilege environment. cvebuzz does not execute the code or verify that an exploit works.
0 repository references · best confidence N/A · max 0 stars
Related records
Similar CVEs
6 related CVEs with shared weakness or product evidence
- CVE-2026-3439CVSS 4.9 · Medium
A post-authentication Stack-based Buffer Overflow vulnerability in SonicOS certificate handling allows a remote attacker to crash a firewall.
- CVE-2026-0402CVSS 4.9 · Medium
A post-authentication Out-of-bounds Read vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2026-0401CVSS 4.9 · Medium
A post-authentication NULL Pointer Dereference vulnerability in SonicOS allows a remote attacker to crash a firewall.
- CVE-2026-0399CVSS 4.9 · Medium
Multiple post-authentication stack-based buffer overflow vulnerabilities in the SonicOS management interface due to improper bounds checking in a API endpoint.
- CVE-2025-40601CVSS 7.5 · High
A Stack-based buffer overflow vulnerability in the SonicOS SSLVPN service allows a remote unauthenticated attacker to cause Denial of Service (DoS), which could cause an impacted…
- CVE-2025-40600CVSS 9.8 · Critical
Use of Externally-Controlled Format String vulnerability in the SonicOS SSL VPN interface allows a remote unauthenticated attacker to cause service disruption.