cyber.hendryadrian.com
Vulnerability & Exploit · thehackernews.com

SonicWall SMA 1000 Flaw Sees 135 Exploitation Attempts After Patch

· Original article ↗

Summary

Threat intelligence firms observed 135 attempts to exploit critical pre-authenticated SSRF flaw CVE-2026-102255 in SonicWall SMA 1000 appliances after patches were released.

Key points

  • CVE-2026-102255 is a pre-authenticated SSRF flaw in SonicWall SMA 1000 appliances, rated CVSS 10.0.
  • The flaw could let remote attackers direct appliance requests, reach internal functionality, and perform unauthorized operations.
  • SonicWall released patches on October 6, 2026: versions 12.4.3-03670 and 12.5.0-03082, both platform hotfixes.
  • Defused Cyber and Previdian detected exploitation attempts beginning October 8.
  • Previdian recorded 135 attempts from two unique U.S. IP addresses; SonicWall had not updated its advisory to note active exploitation.
  • Earlier SMA 1000 flaws were reportedly used to deploy Java web shells and KNUCKLEBALL, steal credentials and MFA seeds, and move into corporate networks.

Article Details

Vulnerability Types
  • Pre-authentication server-side request forgery (SSRF)
Severity
Critical (CVSS 10.0)
Exploitation Status
active
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationThreat actors are actively attempting to exploit the vulnerability in internet-facing SonicWall SMA 1000 appliances.

CVE

CVE-2026-102255The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on theirCVE-2026-154091000 appliances to come under active exploitation. In June 2026, two other flaws in the same product (CVE-2026-15409, CVSS score: 10.0, and CVE-2026-15410, CVSS score: 7.2) were weaponized as zero-days by a threatCVE-2026-15410In June 2026, two other flaws in the same product (CVE-2026-15409, CVSS score: 10.0, and CVE-2026-15410, CVSS score: 7.2) were weaponized as zero-days by a threat actor dubbed UTA0533 to deploy Java web

Threat Actors

UTA0533Named as the threat actor that weaponized two SonicWall SMA 1000 flaws as zero-days in June 2026.

Malware

KNUCKLEBALLas zero-days by a threat actor dubbed UTA0533 to deploy Java web shells and a malware called KNUCKLEBALL.

Vendors

SonicWallThreat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.

Products

SonicWall Secure Mobile Access (SMA) 1000Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.

Countries

United States

Related Articles