SonicWall SMA 1000 appliances are being probed for CVE-2026-102255, a pre-authentication server-side request forgery rated CVSS 10.0. A remote attacker with no login can send requests through the appliance and reach internal functions.
What happened
SonicWall shipped fixes on 6 October 2026 in platform hotfixes 12.4.3-03670 and 12.5.0-03082. Defused Cyber and Previdian first saw exploitation attempts on 8 October, two days later.
Previdian has recorded 135 attempts from two US IP addresses. As of The Hacker News report on 12 October, SonicWall advisory SNWLID-2026-0017 had not yet been updated to mark active exploitation.
This follows earlier SMA 1000 intrusions. In June, CVE-2026-15409 and CVE-2026-15410 were used as zero-days to pull credentials, session databases, and MFA seeds, then pivot into the internal network.
Who is affected
SMA 1000 models 6210, 7210, and 8200v on 12.4.3-03526 and older, or 12.5.0-02952 and older, sit in the affected range published with the October patch. Internet-facing WorkPlace portals are the exposure.
- Fixed builds are 12.4.3-03670 and higher, or 12.5.0-03082 and higher.
- No login is required to abuse the SSRF path.
- A patch does not evict an attacker who already stole sessions or TOTP seeds.
What to do now
Upgrade internet-facing SMA 1000 appliances to 12.4.3-03670 or 12.5.0-03082 or later today, then hunt for unexpected admin sessions and replaced MFA seeds.
If the box was exposed before the hotfix, treat stored credentials and VPN session material as suspect. Restrict management access and review logs for requests that should never have reached internal functions.
Source: The Hacker News, 12 October 2026. Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch.
Also on the blog
- CVE-2026-97229: GitLab CI/CD regex compiler CVSS 10.0 RCE
- Ledger finds unauthorized implant in CryptoBilis-sold wallets
- Palo Alto CVE-2026-0257 Still Used for Ransomware VPN Access
- Bricksforge CVE-2026-85097 CVSS 10 WordPress RCE Exploited
Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.