A critical vulnerability in SonicWall’s SMA1000 appliances is being exploited by threat actors just days after public disclosure. This bug, tracked as CVE-2026-102255 with a CVSS score of 10, is a pre-authenticated server-side request forgery (SSRF) issue that affects the SMA1000 Work Place interface.
SonicWall’s warning on October 6 emphasized the severity of this vulnerability, urging customers to update their 6210, 7210, and 8200v models to software versions 12.5.0-03082 and 12.4.3-03670 as soon as possible. However, it appears that not all users have heeded this warning. On Friday, threat intelligence firms Previdian and Defused reported the first exploitation attempts targeting the vulnerability.
Defused revealed that its SMA decoys were targeted on October 8, just two days after public disclosure. This rapid exploitation is consistent with CVE-2026-102255 (CVSS 10.0), which allows unauthenticated server-side request forgery (SSRF). Previdian similarly reported observing SonicWall SMA1000 exploitation attempts through its sensors.
The potential consequences of successful exploitation are dire: attackers could take over vulnerable devices, giving them control over sensitive systems and data. Horizon3.ai warned that the vulnerability is particularly concerning due to its ease of exploitation and the high stakes involved.
This incident highlights a common challenge in cybersecurity: the window between disclosure and patching is often perilously short. Threat actors are increasingly able to exploit newly revealed vulnerabilities before users can apply necessary updates, putting even the most vigilant organizations at risk.
The swift exploitation of CVE-2026-102255 serves as a stark reminder for businesses and individuals alike to remain proactive in addressing potential security threats. Regularly updating software and hardware is no longer sufficient; staying informed about emerging vulnerabilities and keeping systems up-to-date with patches is crucial in today’s rapidly evolving threat landscape.
To mitigate this risk, it’s essential to prioritize timely patching of all vulnerable devices and systems. Furthermore, implementing robust monitoring and detection capabilities will help organizations quickly identify potential exploitation attempts.
Source: SecurityWeek — 2026-10-12