Attackers started probing a maximum-severity flaw in SonicWall SMA1000 remote-access appliances within two days of the vendor patch. The bug lets an unauthenticated outsider force the appliance to reach internal functions.
What happened
SonicWall disclosed CVE-2026-102255 on 6 October 2026 and rated it CVSS 10. It is a pre-authentication server-side request forgery in the Appliance Work Place interface on SMA1000 models 6210, 7210, and 8200v.
SecurityWeek reported on 12 October that Previdian and Defused saw the first exploitation attempts against SMA decoys on 8 October, two days after disclosure. Horizon3.ai warned that successful use could allow takeover of a vulnerable device. SonicWall's notice at disclosure said there was no evidence of exploitation.
The same hotfix also covers three post-authentication issues: CVE-2026-102256 (command injection), CVE-2026-102257 (Zip Slip), and CVE-2026-102258 (stored cross-site scripting). Builds that fixed an earlier Work Place flaw, including 12.5.0-02952, are still affected.
Who is affected
- SMA1000 6210, 7210, and 8200v on 12.4.3-03526 and earlier, or 12.5.0-02952 and earlier.
- Internet-facing Work Place portals. The SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
- Sites that stopped at the September hotfix and did not move to 12.4.3-03670 or 12.5.0-03082.
What to do now
Upgrade to 12.4.3-03670 or 12.5.0-03082, or a later fixed build on the same branch, and treat any internet-facing SMA1000 that was unpatched after 6 October as potentially probed.
There is no vendor workaround. After the hotfix, review Work Place and management logs for unexpected requests into internal services. If the portal must stay reachable, restrict it to known source networks.
Source: SecurityWeek, 12 October 2026. Critical SonicWall Vulnerability Exploited Days After Disclosure.
Also on the blog
- Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
- Bricksforge CVE-2026-85097 CVSS 10 WordPress RCE Exploited
- CyberXero used Claude Code to steal 628,000 Ukrainian records
- Ledger Confirms Hardware Implant in CryptoBilis Wallets
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.