SonicWall SMA 1000 SSRF flaw sees 135 exploitation attempts
Threat actors have made 135 exploitation attempts against a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances, days after SonicWall released fixes. Previdian recorded the activity from two unique IP addresses located in the United States, while Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026.
The flaw, tracked as CVE-2026-102255, has a CVSS score of 10.0. It is a pre-authenticated server-side request forgery vulnerability that can allow a remote attacker to make an appliance issue requests on the attacker’s behalf, reach internal functionality and perform unauthorized operations.
Hotfixes were released before exploitation appeared
SonicWall issued patches on October 6, 2026. The affected product can be updated with version 12.4.3-03670 (platform-hotfix) or 12.5.0-03082 (platform-hotfix). At the time the exploitation activity was reported, SonicWall had not updated its advisory to state that the vulnerability was being actively exploited.
The short interval between patch publication and observed probing makes the vulnerability significant for organisations running SMA 1000 appliances. The issue does not require prior authentication, and the affected appliance can be exposed as a remote-access entry point to internal environments.
A recurring target for appliance-focused attacks
SMA 1000 has already featured in active exploitation during 2026. In June, threat actor UTA0533 weaponised CVE-2026-15409, also rated 10.0, and CVE-2026-15410, rated 7.2, as zero-days to deploy Java web shells and malware known as KNUCKLEBALL.
The wider pattern is visible in SonicWall attacks among wider security developments where attacks involving SonicWall appeared alongside other security developments, underscoring how internet-facing infrastructure can become an initial access point.
Rapid7 said attackers using the earlier SMA 1000 flaws targeted internet-facing devices, executed operating-system commands and sought persistent access. After gaining a foothold, the actors extracted high-value credentials, active session databases and Time-Based One-Time Password multi-factor authentication seed configurations before moving laterally into corporate networks.
What organisations should do now
Teams responsible for SonicWall SMA 1000 should establish whether affected appliances are running the available platform hotfixes and investigate relevant activity dating from October 8. They should also treat the appliance as a potentially sensitive access boundary when reviewing credentials, active sessions and authentication configurations. The practical business implication is that prompt patch verification and focused log review can help organisations respond while exploitation attempts are already being observed.