Attackers are now exploiting CVE-2026-102255, the maximum-severity (CVSS 10.0) pre-authentication server-side request forgery flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances that we covered on October 7. The bug lets a remote attacker make the appliance send requests on their behalf, reach internal functionality and perform unauthorized operations.
SonicWall shipped hotfixes on October 6. The threat intelligence firms Defused Cyber and Previdian saw the first exploitation signs on October 8, and Previdian’s data shows 135 attempts so far, all from two IP addresses in the United States. The Hacker News reports that SonicWall had not yet updated its advisory to say the flaw is being exploited. The same product line was hit by zero-days in June (CVE-2026-15409 and CVE-2026-15410), when Rapid7 saw attackers steal credentials, session databases and TOTP MFA seed configurations from compromised appliances before moving into internal networks.
How to check if you’re affected
Affected products are SonicWall SMA1000 series appliances (the earlier post lists models 6210, 7210 and 8200v) that have not received the October 6 hotfix. Fixed platform-hotfix versions are 12.4.3-03670 and 12.5.0-03082; check the installed version in the appliance admin console against SonicWall advisory SNWLID-2026-0017 and apply the hotfix now rather than at the next maintenance window. If an unpatched appliance was reachable from the internet after October 6, treat it as potentially probed and review its logs for unexpected outbound or internal requests.
Sources
- SonicWall advisory SNWLID-2026-0017
- Previdian: CVE-2026-102255 exploitation telemetry
- Rapid7: SonicWall SMA1000 zero-days CVE-2026-15409 / CVE-2026-15410
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch — The Hacker News
- Earlier coverage: SonicWall Patches Max-Severity SMA1000 Flaw CVE-2026-102255