Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure.
Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login. Attackers could abuse it to make the appliance send requests and access internal functions, allowing unauthorized actions.
“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.” reads the advisory. “By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
The vendor said it has found no evidence of exploitation, but recommends applying the fixes.
The vulnerability affects the following product and versions:
| Affected Product | Affected Version(s) |
| SMA1000 Models – 6210, 7210, 8200v | 12.4.3-03526 (platform-hotfix) and older versions. 12.5.0-02952 (platform-hotfix) and older versions. |
The company pointed out that the flaws do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
The hotfix is available through the MySonicWall portal, the vendor pointed out that there is no workaround.
Multiple researchers warn the vulnerability is now being actively exploited. Cybersecurity firm Defused has detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys since October 8, 2026. Defused alerted subscribers through its Radar service.
Cybersecurity firm Previdian also announced that its sensors have detected exploitation attempts targeting SonicWall SMA 1000 appliances, consistent with CVE-2026-102255. The reported attacker IP is 146.70.143[.]142.
According to Previdian, researchers have recorded 135 attack attempts from two IP addresses in the United States. Researchers have recorded 135 attempts from two different IP addresses in the United States. SonicWall has not yet updated its security advisory to confirm that attackers are exploiting the flaw.
Follow me on Twitter: @securityaffairs and Facebook and Mastodon
(SecurityAffairs – hacking, SonicWall)
