Critical SonicWall SMA 1000 Flaw Exploited Shortly After Patch

· Cybersecurity

Attackers are actively exploiting a maximum-severity vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances, tracked as CVE-2026-102255 with a CVSS score of 10.0. The flaw is a pre-authenticated server-side request forgery (SSRF) issue that could let unauthenticated attackers perform unauthorized operations on vulnerable devices. According to reports, exploitation attempts began within days of the vulnerability's public disclosure and patch, with roughly 135 exploitation attempts observed. The timing underscores how quickly threat actors now weaponize newly published flaws, leaving organizations minimal time to test and deploy fixes. SonicWall customers who expose SMA 1000 appliances for remote access face the most immediate risk, since the flaw requires no authentication to trigger and the appliances typically sit at the network edge. Administrators are urged to verify they have applied the vendor's patch and to review their appliances for signs of compromise, given that exploitation is ongoing in the wild.

Why it matters：It shows how fast edge-device flaws are weaponized, forcing security teams to shorten patch cycles and prioritize perimeter appliances in vulnerability management.

Key points

  • CVE-2026-102255 carries a CVSS score of 10.0 and is a pre-authenticated SSRF flaw.
  • Roughly 135 exploitation attempts were observed within days of public disclosure.
  • Affected SMA 1000 appliances typically sit at the network edge for remote access.

Sources (original reporting)

More stories from this day