Threat actors started exploiting a recently patched critical vulnerability in SonicWall SMA1000 appliances within days after public disclosure.
Tracked as CVE-2026-102255 (CVSS score of 10), the security defect is described as a pre-authenticated server-side request forgery (SSRF) issue affecting the SMA1000 Work Place interface.
According to SonicWall, an unintended alternate access path could allow a remote attacker “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
The company disclosed CVE-2026-102255 on October 6, urging customers to update their 6210, 7210, and 8200v models to software versions 12.5.0-03082 and 12.4.3-03670.
On Friday, threat intelligence firms Previdian (formerly KEVIntel) and Defused warned of the first exploitation attempts targeting the security bug.
Defused said that the first exploitation attempts reached its SMA decoys on October 8, only two days after public disclosure.
“SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0). The vulnerability allows unauthenticated server-side request forgery (SSRF),” Previdian said.
Successful exploitation of the flaw could allow attackers to take over vulnerable devices, cybersecurity firm Horizon3.ai warned.
Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild
Related: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability
Related: Cisco Patches a Dozen Critical Vulnerabilities
Related: Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication
