Critical SonicWall SMA1000 Vulnerability Exploited Within Days of Patch Release
Threat actors have begun exploiting a recently patched critical vulnerability in SonicWall’s SMA1000 appliances, just days after its public disclosure. Tracked as CVE-2026-102255 (CVSS score: 10), the flaw is a pre-authenticated server-side request forgery (SSRF) issue affecting the SMA1000 Work Place interface.
SonicWall disclosed the vulnerability on October 6, warning that an unintended alternate access path could allow remote attackers to manipulate the appliance into issuing unauthorized requests, potentially accessing internal functionality and performing malicious operations. The company urged customers using 6210, 7210, and 8200v models to update to patched versions 12.5.0-03082 or 12.4.3-03670.
By October 8, threat intelligence firms Previdian (formerly KEVIntel) and Defused reported the first exploitation attempts, with Defused detecting attacks on its SMA decoys just two days after disclosure. Previdian confirmed that its sensors observed active exploitation consistent with CVE-2026-102255, which could enable attackers to take over vulnerable devices.
The rapid exploitation underscores the urgency of applying the patch, as unmitigated devices remain at high risk of compromise.
Source: https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/
SonicWall cybersecurity rating report: https://www.rankiteo.com/company/sonicwall
"id": "SON1791800755",
"linkid": "sonicwall",
"type": "Vulnerability",
"date": "10/2026",
"severity": "100",
"impact": "5",
"explanation": "Attack threatening the organization's existence"{'affected_entities': [{'industry': 'Cybersecurity',
'name': 'SonicWall',
'type': 'Technology Vendor'}],
'attack_vector': 'Server-Side Request Forgery (SSRF)',
'customer_advisories': 'Urgent patch advisory issued to customers using '
'affected models (6210, 7210, 8200v).',
'date_detected': '2023-10-08',
'date_publicly_disclosed': '2023-10-06',
'description': 'Threat actors have begun exploiting a recently patched '
'critical vulnerability in SonicWall’s SMA1000 appliances, '
'just days after its public disclosure. The flaw, tracked as '
'CVE-2026-102255 (CVSS score: 10), is a pre-authenticated '
'server-side request forgery (SSRF) issue affecting the '
'SMA1000 Work Place interface. The vulnerability allows remote '
'attackers to manipulate the appliance into issuing '
'unauthorized requests, potentially accessing internal '
'functionality and performing malicious operations. '
'Exploitation attempts were detected as early as two days '
'after disclosure.',
'impact': {'operational_impact': 'Potential unauthorized access to internal '
'functionality and malicious operations',
'systems_affected': 'SonicWall SMA1000 appliances (6210, 7210, '
'8200v models)'},
'investigation_status': 'Ongoing',
'lessons_learned': 'Rapid exploitation of vulnerabilities underscores the '
'urgency of applying patches promptly.',
'post_incident_analysis': {'corrective_actions': 'Patch deployment and '
'vulnerability remediation.',
'root_causes': 'Unintended alternate access path '
'in SMA1000 Work Place interface '
'allowing SSRF attacks.'},
'recommendations': 'Apply the provided patches (12.5.0-03082 or 12.4.3-03670) '
'immediately to mitigate the risk of compromise.',
'references': [{'source': 'Previdian (formerly KEVIntel)'},
{'source': 'Defused'},
{'source': 'SonicWall Advisory'}],
'response': {'communication_strategy': 'Urgent patch advisory issued to '
'customers',
'remediation_measures': 'Patch to versions 12.5.0-03082 or '
'12.4.3-03670'},
'title': 'Critical SonicWall SMA1000 Vulnerability Exploited Within Days of '
'Patch Release',
'type': 'Vulnerability Exploitation',
'vulnerability_exploited': 'CVE-2026-102255'}