SonicWall Security Bug Targeted in Real-World Attacks After Disclosure

A newly disclosed critical vulnerability affecting SonicWall SMA1000 appliances is already being targeted by attackers, with security researchers observing exploitation attempts just days after patches became available. Tracked as CVE-2026-102255 and carrying a CVSS score of 10.0, the flaw enables unauthenticated threat actors to coerce vulnerable devices into sending network requests on their behalf.

The vulnerability affects SonicWall Secure Mobile Access (SMA) 1000 appliances, which organizations commonly deploy to provide secure remote access to internal business resources. Threat intelligence providers began detecting suspicious activity on October 8, only two days after SonicWall published security updates addressing the issue.

Researchers at Defused Cyber reported observing malicious traffic targeting SMA1000 honeypots and decoy systems, while Previdian identified activity consistent with attempts to exploit the same vulnerability. Although these observations confirm that attackers are actively probing for vulnerable systems, there is currently no public evidence indicating successful compromise of customer networks through this flaw.

SSRF Vulnerability Enables Abuse of Trusted Appliances

CVE-2026-102255 is a Server-Side Request Forgery (SSRF) vulnerability located within the SMA1000 Work Place interface. Due to an unintended alternative access path, attackers can abuse the appliance as a trusted intermediary to send requests to other systems.

Rather than communicating directly with protected services, an attacker can instruct the SMA appliance to issue requests on their behalf. This behavior may allow access to internal services, administrative functions, or resources that would normally be inaccessible from the internet, potentially enabling unauthorized actions within an organization's environment.

The absence of any authentication requirement significantly elevates the risk. Attackers do not need valid credentials, compromised accounts, or user interaction to launch an attack against exposed devices.

Recognizing the severity of the flaw, SonicWall assigned it the highest possible criticality rating, noting the potential impact on confidentiality, integrity, and availability. The company has strongly urged customers to deploy the latest security hotfixes without delay.

Exploitation Began Shortly After Public Disclosure

SonicWall publicly disclosed the vulnerability on October 6, 2026, initially stating that it had not observed evidence of active exploitation. However, subsequent monitoring by security researchers quickly revealed attack activity in the wild.

According to reports, Defused Cyber recorded the first suspicious traffic against its monitoring infrastructure on October 8, highlighting how rapidly threat actors began weaponizing the vulnerability after technical details became public.

Additional telemetry cited by The Hacker News indicates that Previdian logged approximately 135 exploitation attempts originating from two IP addresses located in the United States. These figures represent activity detected by monitoring sensors and should not be interpreted as the number of compromised organizations. Likewise, the geographic location of the observed IP addresses does not necessarily reflect the actual origin of the attackers.

Additional Vulnerabilities Patched

Alongside the critical SSRF issue, SonicWall also addressed three other vulnerabilities affecting SMA1000 appliances:

• CVE-2026-102256 – An authenticated command injection vulnerability that could permit arbitrary code execution.
• CVE-2026-102257 – A Zip Slip path traversal flaw allowing files to be written outside intended directories during archive extraction.
• CVE-2026-102258 – A stored cross-site scripting (XSS) vulnerability capable of executing attacker-supplied JavaScript within the Appliance Management Console.

Unlike CVE-2026-102255, these vulnerabilities require authenticated access to exploit.

Echoes of Previous SonicWall Attacks

SonicWall products have previously been targeted through combinations of SSRF and command injection vulnerabilities that enabled attackers to gain root privileges and deploy custom malware. Similar SMA1000 exploitation campaigns involving remote code execution were reported earlier in the year.

While those incidents provide important context regarding attacker interest in SonicWall remote-access infrastructure, there is currently no evidence linking the latest exploitation attempts to the same threat actors or attack techniques observed in prior campaigns.

Affected Versions and Mitigation Guidance

The vulnerability impacts the following SMA1000 platforms:

• SMA 6210
• SMA 7210
• SMA 8200v

Affected software versions include:

• 12.4.3-03526 and earlier
• 12.5.0-02952 and earlier

Administrators should immediately upgrade to:

• 12.4.3-03670 or later, or
• 12.5.0-03082 or later

using the appropriate software branch for their deployment.

SonicWall has not provided an alternative workaround, making patching the primary remediation option.

It is important to note that the advisory does not affect the SMA 100 series or SSL-VPN services running on SonicWall firewalls. Organizations should verify appliance models and installed firmware versions rather than assuming all SonicWall VPN products are vulnerable.

With exploitation attempts already being observed in the wild, security teams should treat remediation as a high-priority task, rapidly patch exposed SMA1000 systems and review logs for signs of suspicious SSRF-related activity.