Two CVSS 10.0 Bugs Were Exploited This Week and Neither Is in KEV Yet: Bricksforge for WordPress and SonicWall SMA1000
CISA's Known Exploited Vulnerabilities catalog has not changed since October 8. In the meantime, two flaws with the maximum severity score of 10.0 were reported as exploited in the wild. If you wait for KEV to tell you what to patch first, these two are already behind you. One comes with published attacker addresses, which are now in our feed. The other has none in public, and we will say plainly what that means for us.
Bricksforge for WordPress, CVE-2026-85097
Bricksforge is an add-on for the Bricks website builder. Patchstack disclosed an unauthenticated arbitrary file upload in its form handling that leads directly to remote code execution, and logged the first exploitation attempt on October 7 at 21:47 UTC. Versions 3.1.8.9 and earlier are vulnerable. Version 3.1.8.10 fixes it.
The attack is short. The attacker fetches a fresh nonce through the plugin's bricksforge_regenerate_nonce action, then posts a file to /wp-json/bricksforge/v1/form_submit, or the equivalent admin-ajax action, and drops a PHP file named like login_admin_ followed by random characters into the uploads directory. From there it is a web shell.
Patchstack saw attacks from 63 source addresses and published the six most active. All six are now in our feed under source manual-batch-bricksforge-2026-10, each written and read back before we counted it. One of them, 150.109.16.166, sits in the same /24 as an address our own edge honeypot caught earlier. That block is cloud hosting, so treat it as a hint, not a link.
If you run Bricks with Bricksforge, update to 3.1.8.10 now. Then look in wp-content/uploads for PHP files you did not put there, especially anything named login_admin_, and check your access logs for posts to the form_submit route from addresses you do not recognize.
SonicWall SMA1000, CVE-2026-102255
SonicWall disclosed a pre-authentication server-side request forgery in the WorkPlace interface of its SMA1000 remote-access appliances, reached through what it calls an unintended alternate access path. Affected builds are 12.4.3-03526 and 12.5.0-02952 and earlier, on the 6210, 7210 and 8200v. The fixes are 12.4.3-03670 and 12.5.0-03082.
According to public reporting, attackers sent a crafted OPTIONS request to WorkPlace that reached the appliance's internal CouchDB service on the loopback address, port 5984. One telemetry vendor, Previdian, counted 135 exploitation attempts from two US addresses on October 9 and 10. Those addresses are behind a paywall, and SonicWall had not confirmed exploitation at last check. So there is nothing for us to feed, and we will not invent anything.
Correction, October 14: one of those two addresses was not behind the paywall. Previdian posted 146.70.143.142 publicly on X on October 9 at 08:55 UTC, three days before we wrote that there was nothing to feed. We read the telemetry page, saw the paywall, and stopped looking. It is now in our feed (confidence 75, source manual-batch-sma1000-cve-2026-102255, in the default ips.csv). The second address is still paywalled. We have also added SMA1000 decoys to our edge (Edge Shield 2.12.0), because our own edge had zero WorkPlace or Extraweb probes on record: we run no SonicWall, so that zero meant we could not see, not that nobody was looking.
If you run an SMA1000, upgrade to the fixed builds. SMA1000 appliances have been a favorite target for years, and this one needs no credentials.
Why we keep saying "blind spot"
We checked our own edge for both attacks. For Bricksforge, since September 15, we saw no requests on any Bricksforge-specific path. We did see 273 hits on the generic WordPress admin-ajax endpoint, which are the everyday inventory scans every WordPress-shaped host gets, not this exploit. Our exploit harvester picked up the first public proof-of-concept on October 10, three days after exploitation began.
For SonicWall we saw nothing at all, and that is because we do not run an SMA1000 and have no decoy that looks like one. A zero from an instrument that cannot see the thing is not good news. It is the same lesson as the PeopleSoft trap we built this morning for ShinyHunters, and SMA1000 is a candidate for the next one.
Both of these will very likely land in KEV. When they do, you will have been patched for days, or you will be in the logs.
Was this useful? Rate this post. The widget is at the bottom of the page, and we read every response.
How do AI models see YOUR brand?
AIPM has audited 250+ domains. 15 seconds. Free while still in beta.
Audit your site now → aipmsec.com
Was this useful? Thirty seconds, no cookies, no tracking, no third parties, your address hashed and never stored. If the box below does not load, the same question lives at https://analytics.dugganusa.com/nps.html?post=two-cvss-10-exploited-not-in-kev-bricksforge-wordpress-sonicwall-sma1000