[CLSTR]
< Back to situations

Monitor this situation.

[SITUATION] · [QUIET] · [TECHNOLOGY]

4 clusters · 14 sources · 5 days · First seen · Last updated

SonicWall SMA1000 series security vulnerabilities

Overview

SonicWall disclosed several critical security vulnerabilities in its SMA1000 series appliances, including a Server-Side Request Forgery (SSRF) flaw (CVE-2026-102255), an OS command injection vulnerability, a Zip Slip path traversal vulnerability, and a stored cross-site scripting (XSS) vulnerability.

By the following day, reports indicated that the maximum-severity SSRF vulnerability was under active exploitation, allowing unauthenticated remote attackers to perform unauthorized operations by directing the appliance to issue requests on their behalf.

Security researchers at Previdian have confirmed exploitation attempts within 24 hours of disclosure. The SSRF vulnerability, which carries a CVSS score of 10.0, allows unauthenticated attackers to reach internal services via the WorkPlace Extraweb interface. This flaw specifically affects SMA 6210, 7210, and 8200v models.

Recent intelligence from Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026. Data from Previdian indicates that 135 attempts have been observed originating from two unique IP addresses located in the United States. Although SonicWall released patches for the vulnerability on October 6, 2026—specifically versions 12.4.3-03670 and 12.5.0-03082—threat actors continue to target the appliances. This follows a pattern of similar exploits in June 2026, where zero-day flaws in the same product line were used to deploy malware and extract high-value credentials.

Entities

SonicWall · Previdian · Ryan Dewhurst · FBI · Uranium Finance

Timeline

  1. [TECHNOLOGY] 3 sources
    SonicWall SMA 1000 appliances targeted by critical flaw exploitation

    Threat actors are actively exploiting a critical CVE-2026-102255 SSRF vulnerability in SonicWall SMA 1000 appliances, with 135 attempts detected from US-based IP addresses.

  2. [TECHNOLOGY] 6 sources
    Citrix and SonicWall issue urgent patches for critical security flaws

    Citrix and SonicWall face critical security threats as new vulnerabilities in NetScaler and SMA1000 appliances are identified, with SonicWall flaws seeing exploitation attempts almost immediately.

  3. [TECHNOLOGY] 2 sources
    Cybersecurity report: SonicWall vulnerability exploited and new AI-targeting malware

    Cybersecurity reports highlight active exploitation of a SonicWall vulnerability, the rise of PoeLLM AI-targeting malware, and a GitHub supply chain campaign targeting thousands of secrets.

  4. [TECHNOLOGY] 6 sources
    SonicWall and MikroTik disclose critical security vulnerabilities

    SonicWall and MikroTik have disclosed critical security vulnerabilities affecting SMA1000 appliances and RouterOS devices, potentially allowing unauthorized access or credential leakage.

Sources

australiancybersecuritymagazine.com.au · csoonline.com.au · cybernoz.com · dev.to · forkast.news · itnews.com.au · sciencelogic.com · securityaffairs.co · smartermsp.com · thecyberwire.com · theregister.com · truesec.com · venceremos.it · vuejobs.com

This summary has been updated 2 times: see revision history