# SonicWall SMA1000 series security vulnerabilities

> Live situation record from CLSTR: https://clstr.news/situations/sonicwall-sma1000-series-security-vulnerabilities
> Updated: 2026-10-12T18:00:02.000Z. Sources: 14. Developments: 4.

SonicWall disclosed several critical security vulnerabilities in its SMA1000 series appliances, including a Server-Side Request Forgery (SSRF) flaw (CVE-2026-102255), an OS command injection vulnerability, a Zip Slip path traversal vulnerability, and a stored cross-site scripting (XSS) vulnerability.

By the following day, reports indicated that the maximum-severity SSRF vulnerability was under active exploitation, allowing unauthenticated remote attackers to perform unauthorized operations by directing the appliance to issue requests on their behalf.

Security researchers at Previdian have confirmed exploitation attempts within 24 hours of disclosure. The SSRF vulnerability, which carries a CVSS score of 10.0, allows unauthenticated attackers to reach internal services via the WorkPlace Extraweb interface. This flaw specifically affects SMA 6210, 7210, and 8200v models.

Recent intelligence from Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026. Data from Previdian indicates that 135 attempts have been observed originating from two unique IP addresses located in the United States. Although SonicWall released patches for the vulnerability on October 6, 2026—specifically versions 12.4.3-03670 and 12.5.0-03082—threat actors continue to target the appliances. This follows a pattern of similar exploits in June 2026, where zero-day flaws in the same product line were used to deploy malware and extract high-value credentials.

## Timeline

### 2026-10-12: SonicWall SMA 1000 appliances targeted by critical flaw exploitation

Threat actors are actively exploiting a critical CVE-2026-102255 SSRF vulnerability in SonicWall SMA 1000 appliances, with 135 attempts detected from US-based IP addresses.

3 sources. https://clstr.news/cluster/sonicwall-sma-1000-appliances-targeted-by-critical-flaw-exploitation

### 2026-10-10: Citrix and SonicWall issue urgent patches for critical security flaws

Citrix and SonicWall face critical security threats as new vulnerabilities in NetScaler and SMA1000 appliances are identified, with SonicWall flaws seeing exploitation attempts almost immediately.

6 sources. https://clstr.news/cluster/citrix-and-sonicwall-issue-urgent-patches-for-critical-security-flaws

### 2026-10-09: Cybersecurity report: SonicWall vulnerability exploited and new AI-targeting malware

Cybersecurity reports highlight active exploitation of a SonicWall vulnerability, the rise of PoeLLM AI-targeting malware, and a GitHub supply chain campaign targeting thousands of secrets.

2 sources. https://clstr.news/cluster/cybersecurity-report-sonicwall-vulnerability-exploited-and-new-ai-targeting-malware

### 2026-10-08: SonicWall and MikroTik disclose critical security vulnerabilities

SonicWall and MikroTik have disclosed critical security vulnerabilities affecting SMA1000 appliances and RouterOS devices, potentially allowing unauthorized access or credential leakage.

6 sources. https://clstr.news/cluster/sonicwall-and-mikrotik-disclose-critical-security-vulnerabilities

---
Cite as: SonicWall SMA1000 series security vulnerabilities. CLSTR, https://clstr.news/situations/sonicwall-sma1000-series-security-vulnerabilities