THREAT actors are actively exploiting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances less than a week after its public disclosure. The flaw, CVE-2026-102255, is a pre-authenticated server-side request forgery (SSRF) with a CVSS score of 10.0. It could allow an attacker to direct the appliance to issue requests on their behalf, enabling access to internal functionality and unauthorised operations.
Patches were released by SonicWall on 6 October 2026, addressing the issue in two platform hotfixes: 12.4.3-03670 and 12.5.0-03082. Despite the fixes, threat intelligence from Defused Cyber and Previdian reported early exploitation activity, with Previdian documenting 135 exploitation attempts to date from two distinct IP addresses in the United States. SonicWall’s security advisory has not yet been updated to reflect the ongoing exploitation.
Context from other researchers indicates SMA 1000 devices have previously faced weaponised zero-days (CVE-2026-15409 and CVE-2026-15410) earlier in 2026, used to deploy web shells and malware, and Rapid7 described actors extracting credentials and MFA seed configurations after initial access, enabling lateral movement within networks. The new campaign highlights the importance of applying the latest SMA 1000 patches promptly and monitoring for anomalous SSRF-like activity directed at internal interfaces.