SonicWall Flaw Exploited Two Days After Disclosure

Attackers began exploiting CVE-2026-102255, a critical server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 appliances, on Oct. 8, two days after the company disclosed it.

The flaw affects the SMA1000 Work Place interface and has a CVSS severity score of 10. It allows an unauthenticated remote attacker to make an appliance send requests on the attacker’s behalf, reach internal functions and perform unauthorized operations.

SonicWall disclosed the vulnerability on Oct. 6 and described it as an unintended alternate access path. The company urged customers using the 6210, 7210 and 8200v models to install software version 12.5.0-03082 or 12.4.3-03670.

Defused recorded the first exploitation attempts on its SMA1000 decoys on Oct. 8. On Oct. 9, threat intelligence firm Previdian, formerly known as KEVIntel, reported that its sensors had also detected attempts involving the vulnerability.

Previdian reported that its sensor detections were consistent with exploitation of CVE-2026-102255 and described the activity as unauthenticated SSRF.

Cybersecurity company Horizon3.ai warned that successful exploitation could allow attackers to take control of vulnerable appliances. SMA1000 devices provide remote access to internal corporate resources, including from systems exposed to the internet.