Critical SonicWall Flaw Targeted Just Two Days After Disclosure

Attackers began targeting a critical SonicWall vulnerability just two days after the company released a security patch.

Tracked as CVE-2026-102255, the flaw carries a maximum CVSS score of 10.0 and affects SonicWall Secure Mobile Access (SMA) 1000 appliances. Security researchers detected exploitation attempts beginning Oct. 8, following SonicWall's Oct. 6 disclosure and patch release.

The activity puts organizations using these appliances for remote access at risk, although researchers have not confirmed any successful compromises involving the vulnerability.

Researchers detect 135 exploitation attempts

Threat intelligence firms Previdian and Defused Cyber reported suspicious activity targeting CVE-2026-102255 shortly after its disclosure.

According to BleepingComputer, Previdian founder Ryan Dewhurst said the company's honeypots detected specially crafted HTTP requests targeting the WorkPlace Extraweb interface.

The requests attempted to reach an internal CouchDB service through the vulnerable appliance.

Defused Cyber independently observed similar activity against its SonicWall SMA decoys beginning Oct. 8.

By Oct. 12, Previdian had recorded 135 exploitation attempts from two U.S.-based IP addresses, according to The Hacker News.

The researchers have not established whether those attempts successfully compromised any systems.

SonicWall's official advisory still states that the company has no evidence of exploitation in the wild. However, the Canadian Centre for Cyber Security updated its alert on Oct. 9 to acknowledge public reports of exploitation.

How the SonicWall vulnerability works

CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 Appliance WorkPlace interface.

According to the official CVE record, the flaw stems from an unintended alternate access path that could allow an unauthenticated remote attacker to make the appliance send requests to internal services and perform unauthorized operations.

SSRF vulnerabilities can allow attackers to abuse a trusted system's network access to reach resources that would otherwise be inaccessible externally.

Security researchers have warned that successful exploitation could potentially lead to appliance compromise. However, the publicly documented attempts do not establish remote code execution or persistent access through this particular vulnerability.

Which SonicWall appliances are affected?

The flaw affects physical and virtual deployments of SonicWall SMA1000 models 6210, 7210, and 8200v.

SonicWall identified the following affected and patched firmware versions:

The vulnerability does not affect the SMA 100 Series or SSL-VPN functionality running on SonicWall firewalls.

SonicWall released the hotfixes on Oct. 6 alongside fixes for three additional vulnerabilities involving remote code execution, path traversal, and stored cross-site scripting.

Organizations urged to patch vulnerable appliances

SonicWall recommends that organizations running affected SMA1000 appliances upgrade to the fixed firmware versions immediately.

Security teams should also review appliance and network logs for unusual requests targeting the WorkPlace interface, particularly attempts to access internal services.

The activity follows earlier attacks against different SMA1000 vulnerabilities, including flaws exploited to deploy malware and gain persistent access to enterprise networks. However, no public evidence links those campaigns to CVE-2026-102255.

The rapid exploitation attempts also highlight the importance of preparing for attacks that bypass preventive security controls.

Rick Howard, a cybersecurity executive and former chief security officer at Palo Alto Networks, emphasized the importance of resilience in comments shared with eSecurity Planet.

“The only strategy that makes sense for most organizations is resilience. I just need to survive the attack, not prevent it,” Howard said.

The latest activity illustrates how quickly attackers can begin targeting newly disclosed vulnerabilities, leaving organizations with little time to secure exposed systems.

Other news: Cisco has disclosed seven security vulnerabilities affecting six Meraki product families, including critical flaws.