NeuralStackSeveral high-severity vulnerabilities disclosed this week are putting remote-access appliances, AI infrastructure and self-hosted enterprise software under pressure. SonicWall has released hotfixes for four flaws in its SMA1000 appliances, while a separate critical vulnerability in the open-source LMCache project remains unpatched. At the same time, threat actors have begun exploiting an Atlassian Data Center flaw that can provide unauthenticated access to specific files.
The most serious SonicWall issue is tracked as CVE-2026-102255 and carries a CVSS score of 10.0. The server-side request forgery flaw affects WorkPlace, the portal used by SMA1000 users, and can be reached before authentication. SonicWall said an attacker could use the unintended access path to reach internal functionality and perform unauthorized operations, although the company did not specify which functions are exposed.
The four SonicWall flaws affect SMA1000 models 6210, 7210 and 8200v on the platform-hotfix versions identified in the company’s advisory. SonicWall said it has no evidence that any of the issues is being exploited. The appliances provide remote workers with access to company networks and applications, making the pre-authentication weakness particularly significant for organizations that expose them to the internet.
In AI infrastructure, JFrog disclosed CVE-2026-105192 in LMCache, software used to speed up large language model servers such as vLLM. The critical flaw affects LMCache’s multiprocess mode, in which the cache operates as a standalone server and communicates with LLM workers through ZeroMQ. A single network message can execute commands as the user running the LMCache process, without requiring authentication.
The LMCache server is reachable from another machine only when an operator configures it to listen on a routable address rather than its default localhost setting. JFrog rated the vulnerability 9.8 out of 10 for a server bound to a routable address. The issue affects versions 0.3.9 through 0.5.5, and the source text says no fixed version is currently available.
Atlassian’s CVE-2026-21589 is already attracting exploitation attempts. The arbitrary file-access vulnerability has a CVSS score of 9.3 and affects multiple Data Center products, including Bitbucket, Confluence, Jira Service Management, Jira Software, Bamboo, Crowd, Crucible and Fisheye. An unauthenticated attacker can access specific files within an affected application’s web root directory, but exploitation requires prior knowledge of the exact file name and path and does not allow directory listing.
Why this matters
The incidents show how different layers of modern enterprise infrastructure can create high-impact exposure before defenders have a chance to authenticate or inspect an attacker. Remote-access gateways can provide a route toward internal functions, AI-serving components can turn a single network message into code execution when exposed improperly, and self-hosted collaboration platforms may contain sensitive files in locations reachable through a known path.
The immediate risk is uneven across the three cases. SonicWall has issued hotfixes and reported no evidence of exploitation, while LMCache users face a critical vulnerability without a fixed release if they have configured the service on a routable address. Atlassian customers face a different urgency because exploitation attempts have begun against affected Data Center products.
Organizations using these technologies will need to distinguish between internet-exposed and locally bound services, apply available SonicWall and Atlassian fixes, and review whether LMCache multiprocess servers are listening on routable addresses. The source text does not identify the internal Atlassian files that attackers are seeking or the specific SonicWall functions that could be reached, leaving the practical impact dependent on each deployment’s configuration and contents.