BleepingComputer reported on 2026-10-09 that attackers are exploiting the flaw three days after SonicWall's patch, and the Canadian Centre for Cyber Security updated AV26-1017 the same day to note in-the-wild exploitation, so an SMA1000 still on the affected hotfix is exposed to unauthenticated attack right now.
An unintended alternate access path in the SMA1000 Work Place interface lets a remote, unauthenticated attacker make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations. The flaw is rated CVSS 10.0 with scope change, meaning compromise extends beyond the vulnerable component.
Affected: SonicWall SMA1000 (models 6210, 7210, 8200v) 12.4.3-03526 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.4.3-03670 and prior); SonicWall SMA1000 12.5.0-02952 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.5.0-03082 and prior)
How to Test
On each SMA1000 (6210, 7210, 8200v) check the running platform-hotfix build against the affected ranges (12.4.3-03526 / 12.5.0-02952 and older per the CVE record; 12.4.3-03670 / 12.5.0-03082 and prior per AV26-1017) — anything not on the build SonicWall released on 2026-10-06 under SNWLID-2026-0017 should be treated as vulnerable. Review Work Place interface access logs for unauthenticated requests to unexpected paths and for appliance-originated requests to internal services that no user session explains; investigate any such activity since 2026-10-06 as a possible compromise.
How to Patch
Apply the SMA1000 platform-hotfix SonicWall released on 2026-10-06 under SNWLID-2026-0017 for the 12.4.3 and 12.5.0 branches (the dossier does not give the fixed build numbers; take them from that advisory). Until the hotfix is applied, remove the Work Place interface from direct internet reachability.
CISA added this ten-year-old flaw to KEV on 2026-10-08 with a 2026-10-11 remediation deadline, alongside advisory AA26-281A on Chinese government-linked actors, and public exploit code (Exploit-DB 39756, Metasploit struts_dmi_exec) means any remaining Struts 2.3 app with Dynamic Method Invocation enabled is trivially compromisable.
When Dynamic Method Invocation is enabled, a request using the method: prefix can carry a malicious expression that Struts evaluates on the server, letting an unauthenticated attacker execute arbitrary code on the application host. Affects Struts 2.3.20 through 2.3.28 (except 2.3.20.3 and 2.3.24.3).
Affected: Apache Struts 2.3.20 through 2.3.28, except 2.3.20.3 and 2.3.24.3
How to Test
Inventory Java web applications for the struts2-core library and confirm its version is outside the 2.3.20–2.3.28 range (or is 2.3.20.3 / 2.3.24.3 / 2.3.28.1); check your Struts configuration for whether Dynamic Method Invocation is enabled. Review web server and application access logs for action requests containing a method: prefix with unexpected expression content, and treat any such hits on an unpatched instance as a potential compromise requiring host forensics.
How to Patch
Upgrade to Apache Struts 2.3.20.3, 2.3.24.3, or 2.3.28.1 (Apache states no backward-compatibility issues are expected). If the upgrade must wait, disable Dynamic Method Invocation, or implement your own ActionMapper based on the source of the recommended Struts versions as the S2-032 advisory describes.
Supply-Chain Compromisecritical
The workflow runs on push and harvests CI/CD and cloud secrets from whole git histories, so any repository or fork that received it since 8 October has already leaked long-lived tokens that attackers can use for downstream package and image publishing this week.
On 8 October 2026 the GhostAction operators took over two high-profile open-source maintainer accounts — Takashi Kitao (pyxel, 18.4k stars) and Henry Wu/henrywoo (original author of Uber's athenadriver) — and in two automated bursts committed a malicious GitHub Actions workflow to 345 repositories (27 repos from 13:20 UTC, then 318 repos in 16 minutes, 21:10–21:26 UTC). The fake "security audit" workflow exfiltrates GitHub Actions secrets, cloud credentials and secrets mined from the entire git history of each repository; as of 9 October Socket counted more than 500 GitHub accounts that committed the workflow across tens of thousands of repositories.
Affected: Repositories under the compromised accounts Takashi Kitao (pyxel author) — 27 repositories pushed from 13:20 UTC 2026-10-08; Repositories under henrywoo (athenadriver author) — 318 repositories pushed 21:10–21:26 UTC 2026-10-08; Any repository containing an attacker-added .github/workflows/security-audit.yml (500+ accounts, tens of thousands of repos per Socket)
How to Test
Search every org and personal repository (including forks and archived repos) for commits added since 2026-10-08 that create or modify a workflow named security-audit.yml or any workflow that reads ${{ secrets.* }} / iterates git history and POSTs to an external host; cross-check the GitHub Actions run history and the org audit log (repo.add_member, workflows.* , git push events) for runs of such a workflow and for pushes attributed to the compromised maintainer accounts, and review cloud provider logs for use of CI credentials from unfamiliar IPs after that date.
How to Mitigate
Delete the malicious workflow and any attacker commits, then rotate every secret the workflow could reach — repository and organization Actions secrets, OIDC-less static cloud keys, registry/publish tokens (npm, PyPI, Docker), signing keys and any credential ever committed to git history — revoke PATs, SSH keys and OAuth/GitHub App grants on the affected maintainer accounts, enforce hardware MFA plus required reviews on workflow changes, and pin/limit GITHUB_TOKEN permissions to read-only by default.
Huntress published on 2026-10-08 (corroborated by BleepingComputer, The Hacker News and SecurityWeek on 2026-10-09, when VulnCheck also added the CVE to its KEV) that attackers are chaining this authentication bypass with CVE-2026-105134 to drop webshells and XMRig miners on reachable AhsayCBS servers, so a team that leaves its console exposed is handing over its backup server.
A flaw in the checkSysPwd function of the AhsayCBS API (com/ahsay/obs/api/ApiStructsAction.java) lets a remote, unauthenticated attacker manipulate the random argument to bypass authentication to the backup management server. Attackers are chaining it with the CVE-2026-105134 OS command injection to plant webshells and XMRig cryptominers on AhsayCBS hosts, giving them control of the backup infrastructure.
Affected: AhsayCBS 10.3.0; AhsayCBS 10.3.1; AhsayCBS 10.3.2
How to Test
Check the AhsayCBS version in the CBS web console or installation; versions 10.3.0, 10.3.1 and 10.3.2 are listed as affected. Review web server and API access logs for unexpected requests to the API handled by ApiStructsAction / checkSysPwd, especially with unusual values in the random parameter, and for authenticated-looking sessions from unknown source IPs. Hunt the server for webshells dropped in the web application directories and for unknown processes or binaries posing as Microsoft Edge (the reports describe XMRig miners disguised as Edge), unusual CPU consumption, and outbound connections to mining pools. Treat any such finding as a full compromise of the backup server and its stored credentials.
How to Mitigate
No vendor-confirmed fix is established: the CVE record states that upgrading to AhsayCBS 10.3.4 mitigates the issue, but Ahsay's 10.3.4 release notes (05-Aug-2026) list no security fix for it and Huntress, BleepingComputer and SecurityWeek describe the flaws as unpatched as of 2026-10-09. Upgrade to 10.3.4 as the best available step, but do not rely on it alone: immediately restrict network access to the AhsayCBS web console and API to trusted management addresses or a VPN, remove direct internet exposure, and watch for a vendor advisory explicitly addressing CVE-2026-105133 and CVE-2026-105134.