THREAT actors began exploiting a critically rated vulnerability in SonicWall SMA1000 appliances shortly after it was publicly disclosed. CVE-2026-102255 is a pre-authenticated server-side request forgery (SSRF) flaw affecting the SMA1000 Work Place interface. SonicWall stated that an unintended alternate access path could let a remote attacker direct the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations.
The company released patches and linked the CVE to specific model updates: 6210, 7210, and 8200v should run software versions 12.5.0-03082 and 12.4.3-03670. Security firms Previdian (formerly KEVIntel) and Defused reported the first exploitation attempts targeting the bug, with Defused noting that activity appeared on its SMA decoys by 8 October, just two days after public disclosure. Observers such as Horizon3[.]ai warned that successful exploitation could let attackers take over vulnerable devices.
The CVSS score for CVE-2026-102255 is 10.0, underscoring the severity and the urgency of applying the patch on affected SMA1000 deployments.