Attackers Target Critical SonicWall SMA 1000 Flaw Within Days of Patch Release

Threat actors have begun exploiting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of its public disclosure. The flaw, tracked as CVE-2026-102255, has a CVSS score of 10.0, the highest possible. It is a pre-authenticated server-side request forgery issue, which could let a remote attacker direct the appliance to make requests on their behalf, reach internal functionality and perform unauthorised operations.

SonicWall released patches on October 6, 2026, in versions 12.4.3-03670 and 12.5.0-03082 (both platform hotfixes). Threat intelligence firms Defused Cyber and Previdian first detected exploitation attempts on October 8, 2026. Previdian data shows 135 attempts so far from two IP addresses in the U.S. SonicWall has yet to update its advisory to reflect active exploitation.

This is not the first time the product has been targeted. In June 2026, two other flaws in SMA 1000 (CVE-2026-15409 and CVE-2026-15410) were used as zero-days by a threat actor known as UTA0533 to deploy Java web shells and malware called KNUCKLEBALL. Rapid7 reported that attackers used internet-facing devices as a stealthy way in, then extracted credentials, active session databases and multi-factor authentication seed configurations. They then moved from the compromised appliance into the internal corporate network.