Critical SonicWall SMA 100 Vulnerability Exploited in Attacks

Key Takeaways

• A critical server-side request forgery (SSRF) vulnerability, CVE-2026-102255, in SonicWall SMA 1000 appliances is under active exploitation.
• The flaw, rated CVSS 10.0, allows unauthenticated attackers to leverage affected devices as proxies to access internal network resources.
• Exploitation attempts were detected just two days after SonicWall released patches on October 6, 2026.
• Affected organizations should immediately apply the latest hotfixes to all vulnerable SMA 1000 series devices.

A severe vulnerability within SonicWall’s Secure Mobile Access (SMA) 1000 series appliances is now being actively exploited in the wild, mere days after its public disclosure. The flaw, identified as CVE-2026-102255, carries a maximum CVSS score of 10.0, indicating its critical severity and potential for widespread impact.

Security researchers and threat intelligence firms began observing exploitation attempts as early as October 8, 2026, a mere 48 hours after SonicWall issued patches for the issue. This rapid weaponization highlights the urgency for organizations utilizing these remote access solutions to update their systems.

Unauthenticated SSRF Poses Significant Risk

The vulnerability is a server-side request forgery (SSRF) flaw residing in the SMA 1000 WorkPlace interface. This specific weakness creates an unauthorized access pathway, enabling a remote attacker to compel the appliance to act as an intermediary for their requests. Instead of directly targeting protected internal services, attackers can trick the trusted SonicWall appliance into forwarding malicious requests, potentially granting them access to internal network functions and facilitating unauthorized operations.

A key factor elevating the risk of CVE-2026-102255 is the absence of any authentication requirement for its exploitation. Attackers do not need valid credentials or user interaction to trigger the vulnerability, making it exceptionally dangerous and straightforward to leverage for malicious purposes.

SonicWall itself has categorized this flaw as critical, acknowledging its potential to severely compromise data confidentiality, system integrity, and service availability. The company’s product advisory strongly urges all affected customers to implement the latest available hotfixes.

Rapid Exploitation Post-Disclosure

SonicWall initially disclosed the vulnerabilities on October 6, 2026, stating at the time that there was no evidence of active exploitation. However, this assessment quickly changed. Threat intelligence from firms like Defused Cyber and Previdian soon reported attempts against their monitoring systems.

Defused Cyber said that the first suspicious traffic targeting its SMA decoys was observed on October 8, underscoring the swift response by attackers following the public release of vulnerability details and patches. Previdian also documented 135 exploitation attempts originating from two distinct IP addresses located in the United States, although it’s crucial to note these figures represent observed activity against sensors, not necessarily successful compromises of customer networks. Furthermore, the reported IP locations do not definitively indicate the actual geographical origin of the attackers.

Additional Vulnerabilities Addressed

The same SonicWall security release that addressed the critical SSRF vulnerability also patched three other flaws. These include CVE-2026-102256, a command injection vulnerability that could lead to code execution post-authentication; CVE-2026-102257, a Zip Slip issue allowing extracted files to be written outside their intended directories; and CVE-2026-102258, which enables stored JavaScript to execute within the Appliance Management Console. Unlike the critical SSRF flaw, these three vulnerabilities all require authenticated access for exploitation, reducing their immediate risk profile.

While previous SonicWall zero-day attacks have involved similar SSRF and command injection vulnerabilities to achieve root access and deploy custom malware, and reports in September covered remote code execution attacks against SMA 1000, there is no current evidence linking the ongoing exploitation attempts to these earlier campaigns or specific threat actors.

Affected Devices and Mitigation

The critical vulnerability impacts SonicWall SMA 1000 models 6210, 7210, and 8200v running firmware versions 12.4.3-03526 or older, or 12.5.0-02952 or older. Administrators are strongly advised to upgrade their appliances to at least version 12.4.3-03670 or 12.5.0-03082, depending on their current software branch. SonicWall has not provided any workarounds for this vulnerability, emphasizing that patching is the only effective mitigation.

It is important to note that this advisory specifically excludes the SMA 100 product line and SSL-VPN services running on SonicWall firewalls. Administrators should verify their exact appliance model and the installed hotfix versions to avoid unnecessary alarm or oversight. Given the confirmed active exploitation, immediate patching of all affected deployments is paramount.

What You Should Do

• Identify Affected Devices: Confirm if you are running SonicWall SMA 1000 models 6210, 7210, or 8200v with vulnerable firmware versions (12.4.3-03526 or older, or 12.5.0-02952 or older).
• Apply Patches Immediately: Upgrade your appliances to the latest hotfix versions: 12.4.3-03670 or later, or 12.5.0-03082 or later, as appropriate for your software branch. There is no workaround.
• Monitor for Suspicious Activity: Enhance monitoring for unusual network traffic or access patterns originating from or directed towards your SMA 1000 devices.
• Review Access Logs: Scrutinize logs for any unauthorized access attempts or internal resource requests that may have leveraged the SSRF vulnerability.
• Isolate and Patch: If immediate patching is not feasible, consider temporarily isolating affected devices from critical internal networks until updates can be applied.

Disclaimer: HackersRadar reports on cybersecurity threats and incidents for informational and awareness purposes only. We do not engage in hacking activities, data exfiltration, or the hosting or distribution of stolen or leaked information. All content is based on publicly available sources.