SonicWall SMA 1000 appliances targeted by critical flaw exploitation

Threat actors have begun actively exploiting a critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances. The vulnerability, identified as CVE-2026-102255 with a CVSS score of 10.0, is a pre-authenticated server-side request forgery (SSRF).

This flaw allows remote attackers to direct the appliance to issue requests on their behalf, potentially reaching internal functionality and performing unauthorized operations. Intelligence from firms Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026. Data from Previdian indicates that 135 attempts have been observed originating from two unique IP addresses located in the United States.

SonicWall released patches for the vulnerability on October 6, 2026, including versions 12.4.3-03670 and 12.5.0-03082. This incident follows previous exploits in June 2026, where threat actors used zero-day flaws in the same product line to deploy malware and extract high-value credentials.