Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

A critical pre-authenticated server-side request forgery (SSRF) vulnerability, CVE-2026-102255 (CVSS score: 10.0), in SonicWall SMA 1000 appliances is being actively exploited shortly after public disclosure. Patches were released on October 6, 2026, but exploitation attempts began as early as October 8, with 135 observed attempts originating from two unique U.S.-based IP addresses. The flaw allows remote attackers to force the appliance to make unauthorized internal requests, potentially leading to initial access, credential theft, and lateral movement into internal corporate networks.

AI-extracted · verify before operational use