Threat actors started exploiting a recently patched critical vulnerability in SonicWall SMA1000 appliances within days after public disclosure.
Tracked as CVE-2026-102255 (CVSS score of 10), the security defect is described as a pre-authenticated server-side request forgery (SSRF) issue affecting the SMA1000 Work Place interface.
According to SonicWall, an unintended alternate access path could allow a remote attacker “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
The company disclosed CVE-2026-102255 on October 6, urging customers to update their 6210, 7210, and 8200v models to software versions 12.5.0-03082 and 12.4.3-03670.
On Friday, threat intelligence firms Previdian (formerly KEVIntel) and Defused warned of the first exploitation attempts targeting the security bug.
Defused said that the first exploitation attempts reached its SMA decoys on October 8, only two days after public disclosure.