Security researchers have detected active exploitation attempts against a critical vulnerability in SonicWall’s Secure Mobile Access (SMA) 1000 series, just days after the company shipped a fix. The flaw, CVE-2026-102255, carries a CVSS score of 10.0 and is a server-side request forgery, or SSRF, that does not require authentication to exploit.
An SSRF flaw tricks a server into making network requests on an attacker’s behalf. In this case, a remote attacker could direct a vulnerable SMA 1000 appliance to reach internal functionality it should never expose to the outside world, effectively using the appliance itself as a stepping stone into a network it is supposed to protect. SMA 1000 appliances sit at the edge of corporate networks and handle secure remote access, which makes them an attractive target precisely because they are designed to be reachable from the internet.
SonicWall released platform hotfix builds 12.4.3-03670 and 12.5.0-03082 on October 6 to close the hole. Exploitation attempts followed quickly. Security firms Defused Cyber and Previdian both detected scanning activity beginning October 8, just two days after the patch went out. Previdian has since logged 135 separate exploitation attempts originating from two unique IP addresses in the United States. As of this writing, SonicWall has not updated its advisory, tracked as SNWLID-2026-0017, to reflect the active exploitation.
This is not the first time SMA 1000 devices have been targeted. In June 2026, a threat actor tracked as UTA0533 exploited two other flaws in the same product line, CVE-2026-15409 and CVE-2026-15410, as zero-days before patches existed. Incident responders at Rapid7 said the group used those bugs to install Java-based web shells and a custom malware strain called KNUCKLEBALL, then harvested credentials, session data and TOTP multi-factor authentication seeds before moving laterally into victims’ internal networks.
Organizations running SMA 1000 appliances should apply the October 6 hotfix immediately if they have not already, and should assume that any internet-facing appliance left unpatched for more than a few days is a live target rather than a theoretical one. Given the product’s history, reviewing logs for unusual outbound requests from the appliance itself is also worth doing even after patching.
Source: The Hacker News, “Critical SonicWall SMA 1000 Flaw Hit With 135 Exploitation Attempts Just Days After Patch,” October 12, 2026.
