Critical SonicWall Vulnerability Exploited in Attacks Following Disclosure

A critical SonicWall SMA1000 flaw, CVE-2026-102255 (CVSS 10.0), is being actively exploited days after disclosure, allowing unauthenticated attackers to make vulnerable appliances send requests on their behalf.

Threat intelligence firms detected exploitation attempts beginning October 8, two days after SonicWall released fixes. The activity affects SonicWall Secure Mobile Access appliances used to provide remote access to business resources.

Defused Cyber reported suspicious traffic against its SMA decoys, while Previdian detected attempts consistent with the same vulnerability.

These findings show attackers are targeting the flaw, although the available reports do not establish successful breaches of customer networks.

The flaw is a server-side request forgery, or SSRF, issue in the SMA1000 Work Place interface. An unintended alternate access path allows a remote attacker to use the appliance as a proxy.

Instead of sending requests directly to protected services, the attacker makes the trusted appliance send them, potentially reaching internal functions and carrying out unauthorized operations.

The lack of a login requirement makes this vulnerability especially serious. Attackers don’t need a stolen account or user interaction to exploit it.

SonicWall assigned the flaw a critical rating because it could impact on data confidentiality, system integrity, and service availability. Its product notice urges affected customers to install the latest hotfix.

Critical SonicWall Vulnerability Exploited

SonicWall disclosed the vulnerabilities on October 6, 2026. Its notice stated that there was no evidence of exploitation in the wild. Later observations changed the picture, with Defused and Previdian reporting attempts against their monitoring systems. Defused Cyber said the first traffic reached its decoys on October 8, showing how quickly attackers moved after disclosure.

According to The Hacker News, Previdian recorded 135 attempts from two IP addresses located in the United States. Those figures describe activity seen by its sensors, not the number of compromised organizations. The IP addresses’ locations also do not indicate where the attackers were based.

The same release addresses three additional flaws. CVE-2026-102256 involves command injection that can allow code execution after authentication.

CVE-2026-102257 is a Zip Slip issue that can write extracted files outside their intended directory. CVE-2026-102258 allows stored JavaScript to run in the Appliance Management Console. These issues require authenticated access, unlike the critical SSRF flaw.

Earlier SonicWall zero-day attacks used separate SSRF and command injection vulnerabilities to gain root access and deploy custom malware. Cybersecurity News also covered SMA1000 remote code execution attacks in September. Those reports provide relevant background, but they do not prove the current attempts involve the same attackers or techniques.

Affected devices include SMA1000 models 6210, 7210, and 8200v running 12.4.3-03526 or older, or 12.5.0-02952 or older. Administrators should upgrade to 12.4.3-03670 or later, or 12.5.0-03082 or later, using the appropriate software branch. SonicWall lists no workaround.

The advisory excludes the SMA 100 product line and SSL-VPN services on SonicWall firewalls. Administrators should confirm their exact appliance model and installed hotfix rather than assume every SonicWall VPN product is affected. With exploitation attempts already reported, affected deployments warrant urgent patching.

Update defenses against new malware as soon as it appears. Integrate TI Feeds with data from 16K SOCs.

The post Critical SonicWall Vulnerability Exploited in Attacks Following Disclosure appeared first on Cyber Security News.