SonicWall SMA1000 Flaw Exploited Days After Disclosure
Summary
Attack attempts targeting critical pre-authentication SSRF flaw CVE-2026-102255 in SonicWall SMA1000 appliances were observed two days after disclosure. SonicWall urged customers to update affected models.
Key points
- CVE-2026-102255 is a pre-authentication server-side request forgery vulnerability in the SMA1000 Work Place interface, rated CVSS 10.
- The flaw could let remote attackers direct appliances to make requests, reach internal functionality, and perform unauthorized operations.
- SonicWall disclosed the issue on October 6 and recommended updates for SMA1000 models 6210, 7210, and 8200v.
- The recommended software versions are 12.5.0-03082 and 12.4.3-03670.
- Defused reported first exploitation attempts against its SMA decoys on October 8; Previdian also observed attempts.
- Horizon3.ai warned that successful exploitation could allow attackers to take over vulnerable devices.
Article Details
- Vulnerability Types
- Pre-authenticated server-side request forgery (SSRF)
- Severity
- Critical; CVSS 10
- Exploitation Status
- active
- Exploit Availability
- unknown
- Patch Status
- available