Critical SonicWall SMA 1000 Flaw Exploited Days After Patch

Attackers began exploiting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 remote-access appliances within days of its public disclosure.

The flaw, tracked as CVE-2026-102255 and carrying the maximum CVSS score of 10.0, is a pre-authenticated server-side request forgery (SSRF). It lets a remote attacker direct the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations.

SonicWall shipped fixes on October 6, 2026, in versions 12.4.3-03670 and 12.5.0-03082 (both as platform hotfixes).

Exploitation came almost immediately

The first signs of exploitation were detected on October 8 by threat-intelligence firms Defused Cyber and Previdian. According to Previdian, a total of 135 attempts have been observed so far, originating from two unique IP addresses located in the U.S. SonicWall has yet to update its advisory to acknowledge the active exploitation.

CVE-2026-102255 is not the first SMA 1000 flaw to draw fire. In June 2026, two other bugs in the same product (CVE-2026-15409 at 10.0 and CVE-2026-15410 at 7.2) were weaponized as zero-days by a threat actor dubbed UTA0533, which deployed Java web shells and a piece of malware called KNUCKLEBALL.

From the gateway into the corporate network

Rapid7 reported that attackers used the flaws as a stealthy initial-access vector against internet-facing devices: once in, they executed commands at the operating-system level and secured long-term, persistent access.

According to Rapid7, after establishing a foothold the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) MFA seed configurations. Armed with those resources, they quickly moved laterally, pivoting from the compromised appliance straight into the internal corporate network.

Organizations running SMA 1000 appliances are advised to apply the released updates without delay.

Source: The Hacker News