Science & Tech · Cybersecurity · 2 hrs ago
Critical SonicWall flaw faces exploitation days after patch
A critical security flaw in SonicWall SMA 1000 appliances is being targeted by attackers.
The flaw affects the appliances’ Work Place interface and can be exploited without logging in.
It could let an attacker make an appliance send requests and reach internal functions, potentially taking control of a vulnerable device.
SonicWall disclosed the flaw and released software updates on October 6, 2026.
The first exploitation attempts were detected two days later, and 135 attempts from two US-based IP addresses have been observed.
The activity matters because compromised appliances could provide a way into an organization’s internal network.
The available information does not say what attackers will do next.
Threat actors have made exploitation attempts against a critical vulnerability in SonicWall SMA 1000 appliances within days of its public disclosure.
The flaw, CVE-2026-102255, is a pre-authenticated server-side request forgery vulnerability with a CVSS score of 10.
SonicWall released patches on October 6, 2026, and urged customers to update affected models.
The first exploitation attempts were detected on October 8, according to threat intelligence firms.
Previdian reported 135 attempts from two unique IP addresses in the United States.
- Who
- Threat actors are attempting to exploit CVE-2026-102255; the attempts were detected by Defused Cyber and Previdian.
- What
- A critical, pre-authenticated server-side request forgery flaw in SonicWall SMA 1000 appliances is being targeted.
- When
- Patches were released on October 6, 2026, and first exploitation attempts were detected on October 8.
- Where
- SonicWall SMA 1000 appliances; Previdian observed attempts from two IP addresses in the United States.
- Why
- The flaw could let a remote attacker direct an appliance to make requests and reach internal functionality to perform unauthorized operations.
This story does not have two clearly opposing sides.
to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.
SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0). The vulnerability allows unauthenticated server-side request forgery (SSRF).
SonicWall disclosed CVE-2026-102255 and released patches for the vulnerability.
Defused and Previdian detected the first exploitation attempts.
The Hacker News reported that Previdian had observed 135 attempts from two unique U.S. IP addresses.
- Vulnerability
- CVE-2026-102255
- Severity
- CVSS 10.0
- Affected product
- SonicWall SMA 1000 appliances
- Patch date
- October 6, 2026
- Observed attempts
- 135
- Source IP addresses
- Two, located in the United States
Sources
Related news
Canadian cybersecurity executive arrested in FBI ShinyHunters investigation
Ricardo users receive phishing messages after data leak
Canadian cybersecurity executive arrested on federal extortion charges
Preinstalled malware found on low-cost Android phones in more than 150 countries
Dark Reading names a new editor-in-chief after 20 years
CyberXero campaign steals more than 628,000 records tied to Ukrainians
UK minister says cyber defences are likely to be breached
DDoS attack disrupts Canonical websites for more than four hours
Cyberattack Disrupts Refrigeration at French Supermarkets
Free online cybercrime helpline launches in South Africa
Let’s Encrypt to shorten default certificate validity to 64 days in 2027
