SonicWall and Splunk have released security updates addressing multiple critical- and high-severity vulnerabilities that could enable unauthorized access, remote code execution (RCE), and other malicious activity. SonicWall patched four (4) vulnerabilities affecting its SMA1000 appliances, including CVE-2026-102255 (CVSS 10/10), a pre-authentication server-side request forgery (SSRF) flaw that allows unauthenticated remote attackers to exploit an unintended access path to reach internal functionality and perform unauthorized operations. SonicWall also addressed three (3) additional vulnerabilities that could enable RCE and cross-site scripting (XSS), urging customers to upgrade to versions 12.5.0-03082 or 12.4.3-03670. Although no active exploitation of these newly patched flaws has been observed, Shadowserver identified more than 400 Internet-exposed SMA1000 appliances, highlighting potential exposure. The disclosure follows multiple SonicWall zero-day exploitation campaigns throughout 2026, including attacks linked to ransomware operations and malware deployment, reinforcing the continued targeting of enterprise VPN infrastructure. Meanwhile, Splunk patched dozens of vulnerabilities across Splunk Enterprise, MCP Server, and Add-on for Amazon Web Services, including three (3) critical flaws that could enable arbitrary command execution, unauthorized access, and code injection. Additional fixes address weaknesses involving attacker-controlled API requests and vulnerable third-party packages. CTIX analysts urge organizations to follow the guidance from both vendors and promptly apply security updates to mitigate potential exploitation and protect critical enterprise infrastructure.