SonicWall, Atlassian, and PeopleSoft Flaws Under Active Exploitation

Active exploitation hits remote access, collaboration, and HR systems

Attackers are exploiting a maximum-severity flaw in SonicWall's SMA1000 remote-access appliances, a critical file-access vulnerability across eight Atlassian Data Center products, and an unpatched Oracle PeopleSoft weakness that bypassed web-application firewalls. Together, these attacks increase immediate patching costs and strengthen the case for migrating perimeter infrastructure to cloud-delivered alternatives.

The pattern matters more than any single vulnerability: exploitation is concentrating on internet-exposed legacy systems where patching competes with uptime requirements and where attackers can reach employee data, source code, or internal networks in a single step.

SonicWall SMA1000 vulnerability allows remote, unauthenticated attacks

CVE-2026-102255 permits a remote attacker to induce the SMA1000 appliance to make requests on their behalf, reach internal functionality, and perform unauthorized operations. Security researchers at Previdian observed exploitation attempts against honeypots after SonicWall issued a patch on October 6.

The vulnerability affects the SMA1000's WorkPlace interface, which has now been targeted by three separate server-side request forgery flaws disclosed in July, September, and October. The repeated targeting of the same component increases the probability that attackers have developed reliable tooling and that unpatched devices will face automated scanning.

Enterprises using SMA1000 should validate whether the appliance is internet-exposed, inspect outbound requests and administrative activity for signs of compromise, and patch immediately. Buyers with limited appliance-patching capacity should compare the total cost of emergency remediation, threat hunting, and recurring zero-day risk against migration to Palo Alto Networks, Cloudflare, or other zero-trust access platforms. The competitive advantage of on-premises VPN appliances narrows when patching becomes a monthly emergency.

Atlassian Data Center flaw exposes source code, project data, and secrets

Atlassian disclosed CVE-2026-21589, a critical arbitrary-file-access vulnerability rated CVSS 9.3, on October 5. The flaw affects Bitbucket Data Center, Confluence Data Center, Jira Service Management Data Center, Jira Software Data Center, Bamboo Data Center, Crowd Data Center, Crucible, and Fisheye. Threat actors have reportedly begun exploiting the vulnerability.

The breadth of the affected portfolio creates a higher-priority issue than a single-product flaw: one unpatched vendor ecosystem can expose source code, CI/CD secrets, service-management records, build systems, and identity data. Security teams need an inventory of every affected Data Center product, not merely the highest-profile Jira or Confluence instances.

Buyers should patch immediately, review file-access logs, rotate credentials where exposure is possible, and inspect secrets stored in Bitbucket or Bamboo repositories. The 9.3 CVSS score and reported exploitation justify temporary procurement of emergency scanning, managed detection, or incident-response services where internal teams cannot complete validation within 48 hours.

The episode also raises a structural question: whether self-managed Data Center deployments provide sufficient patching speed and isolation compared with cloud-hosted Atlassian or competing SaaS platforms such as GitHub Enterprise, GitLab, ServiceNow, or Microsoft Azure DevOps. The cost of emergency patching, forensic review, and credential rotation should be included in total-cost-of-ownership comparisons.

PeopleSoft exploitation bypassed firewall controls

The cybercrime group ShinyHunters resumed large-scale exploitation of CVE-2026-35273 in Oracle PeopleSoft Enterprise PeopleTools, according to reporting citing Google's Mandiant unit. The flaw is remotely exploitable without authentication through HTTP and affects PeopleTools versions 8.61 and 8.62.

The campaign targeted organizations that had deployed web-application-firewall rules but had not installed Oracle's available security update. The FBI's job portal was breached through the unpatched vulnerability, exposing personal information belonging to thousands of FBI employees.

The breach demonstrates that WAF deployment should not be treated as a substitute for vendor patching. Enterprises running PeopleTools 8.61 or 8.62 should verify patch status, inspect web and application logs for exploitation, isolate internet-facing portals, and assess whether exposed applicant or employee data triggers notification obligations.

Buyers may need to fund emergency application testing, forensic review, identity monitoring, and accelerated HCM modernization. The incident creates a measurable argument for prioritizing application modernization over adding another perimeter-control product. The competitive case for migrating high-value recruiting and employee workflows to SAP SuccessFactors, Workday, or Oracle Fusion Cloud HCM strengthens when legacy PeopleSoft components become recurring breach vectors.

Vulnerability exploitation now leads as breach entry point

A newly published research report states that ransomware breaches increased 236% in 2026, while unpatched vulnerabilities, stale accounts, and poor security configurations remained major entry points. A separate report citing Verizon's 2026 Data Breach Investigations Report says vulnerability exploitation became the leading initial-access vector for breaches for the first time in the report's 19-year history.

This favors exposure-management, attack-path analysis, and vulnerability-prioritization vendors such as Tenable, Qualys, Rapid7, Wiz, and CrowdStrike. The competitive distinction is shifting from raw vulnerability counts to demonstrated reduction in exploitable attack paths and remediation time.

Security leaders should expect budget scrutiny around whether existing scanners are reducing exploitable exposure. Procurement criteria should emphasize asset coverage, identity context, attack-path prioritization, automated remediation, and evidence of lower mean time to remediate rather than the number of findings generated.

What to do now

Patch or isolate SonicWall SMA1000 systems and investigate suspicious outbound requests and administrative actions. Inventory and patch all affected Atlassian Data Center products; review access to repositories, build systems, and secrets. Verify PeopleSoft PeopleTools patch status and isolate internet-facing portals. Reassess whether legacy on-premises infrastructure provides sufficient patching speed compared with cloud-delivered alternatives, and include emergency remediation costs in total-cost-of-ownership calculations.