Recently, a critical security vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances has come under active exploitation just days after its public disclosure. This vulnerability, identified as CVE-2026-102255, poses significant risks, with a maximum CVSS score of 10.0. It allows threat actors to perform server-side request forgery (SSRF) attacks, potentially leading to unauthorized operations.
Details of the Vulnerability
The flaw, detailed as a pre-authenticated SSRF, grants remote attackers the capability to manipulate the SonicWall appliance into executing requests on their behalf. This can expose internal functions and enable unauthorized actions. SonicWall responded by releasing patches on October 6, 2026, in the form of platform-hotfix updates, specifically versions 12.4.3-03670 and 12.5.0-03082.
Exploitation Attempts and Detection
Despite the rapid release of patches, threat intelligence firms such as Defused Cyber and Previdian detected initial exploitation activities by October 8, 2026. Data from Previdian has recorded 135 exploitation attempts emanating from two distinct IP addresses in the United States. Although active exploitation cases have been reported, SonicWall has not yet updated its advisory to reflect these developments.
Broader Implications and Previous Exploits
The recent exploitation of CVE-2026-102255 adds to a series of vulnerabilities impacting SonicWall SMA 1000 devices. Earlier, in June 2026, vulnerabilities CVE-2026-15409 and CVE-2026-15410 were manipulated by the threat group UTA0533. These issues were exploited to deploy Java web shells and the KNUCKLEBALL malware.
Security company Rapid7 has observed attackers leveraging these vulnerabilities to infiltrate internet-facing devices. This method provides a covert initial access point, allowing them to execute commands on the operating system and establish long-term access. This access facilitates the extraction of valuable credentials and session databases, as well as multi-factor authentication configurations.
The exploitation of these vulnerabilities underscores the importance of timely patching and vigilant monitoring of network security systems. Organizations using SonicWall appliances are urged to apply the latest hotfixes and ensure robust security measures are in place to mitigate potential threats.
