SonicWall, Apple, WordPress: What This Week's Actively Exploited Vulnerabilities Mean for Your Business
Three new entries hit CISA’s Known Exploited Vulnerabilities catalogue this week. SonicWall SonicOS SSLVPN, multiple Apple products, and WordPress Core.
Let’s be precise about what that means. CISA does not add vulnerabilities to the KEV catalogue because they are theoretically interesting. They add them when there is confirmed, documented evidence that attackers are actively exploiting them in the wild. By the time something appears on that list, the attack tooling exists, the campaigns are running, and the question is not whether your systems are being targeted. It is whether they are patched.
This is the week’s intelligence signal that actually matters for UK small businesses. Not the seventeen critical CVEs across IBM enterprise software that your organisation almost certainly does not run. Not the Kyverno Kubernetes admission controller vulnerability that requires a cluster environment most five-to-fifty person businesses will never operate. The three confirmed, actively exploited vulnerabilities affecting infrastructure that is genuinely common at the SMB level.
Here is what the data says, and what to do with it.
SonicWall SonicOS SSLVPN: Your Remote Access Is the Target
SonicWall’s SSLVPN functionality in SonicOS is confirmed exploited. This matters disproportionately to small businesses because SonicWall has historically been one of the more affordable enterprise-grade firewall and VPN vendors. It is widespread in the SMB and lower mid-market, precisely the segment that often lacks the in-house capability to monitor CISA’s catalogue in near real-time.
SSLVPN is remote access. It is the mechanism that allows staff to connect to your network from home, from client sites, from anywhere. A vulnerability in that component is not a peripheral risk. It is a direct attack surface against the perimeter of your entire network.
The exploitation pattern for VPN vulnerabilities at this level typically follows a consistent playbook. Attackers identify unpatched instances through automated scanning, exploit the vulnerability to gain initial access or extract credentials, and then either deploy ransomware or sell that access to other criminal groups on access broker markets. The gap between a VPN vulnerability appearing on the KEV catalogue and ransomware deployment can be measured in days, sometimes hours.
If you have SonicWall hardware on your network, the firmware version needs to be verified today. Not this month. Today.
Apple Products: The Devices in Everyone’s Pocket
Apple products covering multiple product lines are confirmed exploited this week. iPhones, Macs, iPads. The devices that your staff almost certainly use for work email, calendar access, file sharing, and in many cases banking and finance applications.
The CISA KEV entry covering Apple this week reflects a pattern that has become more pronounced over the past two years. Apple’s ecosystem, once treated as a relatively lower-risk environment in SMB settings, is now a consistent target. The prevalence of Apple hardware in business environments, combined with the assumption among many users that it requires less active security management, makes it attractive.
Apple patches are delivered through standard system updates on iOS, iPadOS, and macOS. The mechanism is straightforward. The barrier is usually organisational: staff do not update promptly, devices are not enrolled in mobile device management so there is no visibility into patch status, and nobody is checking.
In a business of twenty people, unmanaged Apple devices are essentially invisible from a security standpoint. You do not know what version of iOS the sales director is running. You do not know whether the marketing coordinator’s MacBook applied last week’s update. That gap in visibility is the gap attackers use.
WordPress Core: The Website That Became an Attack Vector
WordPress Core is the third confirmed exploited vulnerability this week. WordPress powers a substantial proportion of UK small business websites. It is the default choice for businesses that need a managed site with a reasonable budget, and for the agencies and developers who build those sites.
The risk profile here is different from the SonicWall and Apple entries. A compromised WordPress site is not automatically a compromised internal network. But it is not a contained problem either.
Attackers who gain control of a WordPress installation can redirect visitors to malicious sites, serve malware through the browser, harvest contact form submissions, access any credentials stored in the database, and use the site’s hosting infrastructure as a launchpad for further attacks. If your WordPress admin panel shares credentials with any other system, the blast radius expands immediately.
WordPress sites that are not actively maintained are extremely common. A site built three years ago, handed over to the client, and not touched since is running outdated core files, outdated plugins, and outdated themes. Attackers scan for these automatically. The scanning is not targeted. It is industrialised.
If you have a WordPress website and you cannot immediately confirm that core, themes, and all plugins are on their current versions, you have an unquantified exposure.
What This Means for Your Business
Three items to verify before the end of this working week.
First: SonicWall firmware. If you have a SonicWall device, log into the management interface or ask your IT provider to confirm the current firmware version and whether it addresses the actively exploited SSLVPN vulnerability. Get the confirmation in writing, with the version number. ‘We handle updates’ is not a sufficient answer this week.
Second: Apple device updates. On every Apple device used for work, go to Settings, then General, then Software Update. If there is an update available, install it. If your business uses mobile device management, ask your IT provider to confirm patch compliance status across enrolled devices. If you do not use MDM and you have more than five Apple devices in use for business purposes, that gap in visibility is worth addressing.
Third: WordPress. Log into your WordPress admin panel and go to Dashboard, then Updates. If there are updates available for core, themes, or plugins, apply them. If you do not have admin access to your own website, contact whoever built or manages it and ask them to confirm the current patch status. If the answer takes more than twenty-four hours, that tells you something about the management arrangement.
How This Gives You an Edge
Most of your competitors are not monitoring CISA’s KEV catalogue. They are not running this check this week. They will find out about the SonicWall exposure when their MSP mentions it at the next quarterly review, or when it is too late.
Businesses that treat the KEV catalogue as a weekly operational input, not a theoretical reference document, have a measurable advantage. When a customer or prospect asks how you manage cyber security, being able to say ‘we monitor CISA’s confirmed exploit list and verify patch status within the working week’ is a concrete, verifiable differentiator. It is evidence-based security management, not compliance theatre.
If you hold Cyber Essentials or Cyber Essentials Plus certification, prompt patching of actively exploited vulnerabilities is directly relevant to your certification maintenance. Patch management is a core control. The KEV catalogue is effectively a prioritised patch list produced by a government agency at no cost.
Making the Business Case
Three points for the conversation with whoever controls the IT budget.
The CISA KEV catalogue represents confirmed active exploitation, not vendor-generated fear. This is US government threat intelligence, produced independently of any product or service being sold. When something appears on that list, the attacks are already happening.
The cost of patching is a known quantity. The cost of a ransomware incident is not. For UK small businesses, the ICO’s published enforcement data shows breach costs routinely running into the tens of thousands of pounds before legal, remediation, and notification costs are included. SonicWall VPN compromises have been documented as the initial access vector in ransomware deployments that shut businesses down for days or weeks.
This week’s three KEV entries require no new spend. SonicWall firmware updates, Apple system updates, and WordPress core updates are all delivered through existing mechanisms at no additional cost. The barrier is time and attention, not budget.
If this was useful, follow the show wherever you listen. A rating or review helps more people find it, and if you know a business owner who is running SonicWall kit or a neglected WordPress site, share it with them. It might be the most useful thing they read this week.