THREAT actors are actively exploiting a maximum-severity vulnerability in SonicWall SMA 1000 appliances, specifically CVE-2026-102255, a server-side request forgery (SSRF) flaw in the WorkPlace interface used for remote access. SonicWall describes the issue as resulting from an unintended alternate access path that could allow a remote unauthenticated attacker to direct the SMA appliance to issue requests on behalf of the attacker, potentially reaching internal functionality and performing unauthorized operations. The advisory announcing the flaw was published on 6 October.
Industry observers began reporting exploitation attempts a few days later. On 9 October, Previdian warned it had observed exploitation attempts on its sensors, while Defused noted unauthenticated SSRF traffic on SonicWall SMA decoys starting the day before. SonicWall initially stated there was no evidence of active exploitation for CVE-2026-102255 or the three other CVEs disclosed in its advisory, though responses from third parties indicated activity.
The vendor released a hotfix and urged customers to apply it promptly. Notably, SonicWall emphasised that SSL-VPNs running on SonicWall firewalls or the SMA 100 Series are not affected by CVE-2026-102255 or the other disclosed CVEs. Industry commentary underlines the elevated risk posed by internet-facing edge devices, and insurers’ responses reflect the potential impact on claims and premiums.