Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Attackers moved quickly against CVE-2026-102255 after SonicWall released fixes for the SMA 1000 flaw. Patches became available on October 6, 2026, but threat intelligence firms detected the first exploitation signs on October 8. The speed matters because internet-facing security appliances can be reached directly by remote attackers.

Previdian observed 135 exploitation attempts from two unique IP addresses in the United States. Defused Cyber also detected the first signs of exploitation. The activity targeted a critical, pre-authenticated SSRF vulnerability with a CVSS score of 10.0. That means attackers did not need to authenticate before attempting to abuse the appliance.

SonicWall has not updated its advisory to reflect active exploitation. Organizations using SMA 1000 appliances should therefore treat patching as urgent and confirm that the listed platform-hotfix versions are installed. The activity also shows that public disclosure can be followed by exploitation within days, leaving little time for unpatched devices.

Server-side request forgery, or SSRF, occurs when an attacker tricks a server into sending a request to a destination chosen by the attacker. The server makes the request, so it may reach internal services or functions that are not directly exposed to the internet. “Pre-authenticated” means the attacker can attempt this before proving their identity or logging in.

In CVE-2026-102255, the SonicWall SMA 1000 appliance can be directed to issue requests on an attacker’s behalf. The article says those requests may reach internal functionality and perform unauthorized operations. The flaw received a CVSS score of 10.0, reflecting its critical severity.

This matters because SMA appliances sit at the network edge and can expose powerful internal functions. Attackers began testing the flaw on October 8, shortly after patches were released. Defending against it requires applying SonicWall’s platform-hotfix versions and checking for suspicious activity, although the article does not describe specific detection steps.

The observed activity reached 135 exploitation attempts against CVE-2026-102255. Those attempts came from only two unique IP addresses, and Previdian located both addresses in the United States. The figures show confirmed probing activity, but they do not establish how many appliances were successfully compromised.

Previdian supplied the attempt count, while Defused Cyber and Previdian detected the first signs of exploitation on October 8, 2026. That date came two days after SonicWall released patches for the critical SMA 1000 vulnerability. The flaw carries a CVSS score of 10.0 and can be exploited before authentication.

The small number of source addresses should not be mistaken for low risk. A single address can generate many requests, and the article does not identify the targeted appliance count or report successful intrusions. SonicWall’s advisory still had not been updated for active exploitation, making the observed figures an important warning for defenders.

CVE-2026-102255 could let a remote attacker direct an SMA 1000 appliance to issue requests on the attacker’s behalf. Because the flaw is pre-authenticated, the attacker does not need valid credentials before attempting to use it. The requests can reach internal functionality and perform unauthorized operations.

The article describes the flaw as a critical SSRF vulnerability with a CVSS score of 10.0. It does not list every operation that could be performed through the flaw. However, the broader activity shows why appliance compromise matters: Rapid7 observed attackers using internet-facing devices as an initial access vector and executing operating-system commands in related SonicWall SMA attacks.

Once attackers establish a foothold, the article says they extracted credentials, active session databases, and TOTP MFA seed configurations. They then pivoted directly into the internal corporate network. The exact consequences of each successful CVE-2026-102255 exploit remain unspecified in the article, but unauthorized appliance operations and internal access are clear risks.

Network appliances are valuable because they sit between the public internet and internal corporate systems. The article says Rapid7 observed attackers targeting internet-facing devices as a stealthy initial access vector. Compromising one can give attackers a position close to the network they ultimately want to enter.

After establishing a foothold on a SonicWall appliance, attackers systematically extracted high-value credentials, active session databases, and TOTP MFA seed configurations. They also used compromised devices to execute commands on the operating system and maintain long-term, persistent access. These capabilities make the appliance more than a simple access point.

The attackers then used the harvested resources for lateral movement, pivoting directly into the internal corporate network. The article links this behavior to earlier SonicWall SMA attacks, while CVE-2026-102255 is the latest SMA 1000 flaw under active exploitation. Internet-facing appliances therefore require rapid patching and close monitoring after new flaws are disclosed.

The earlier SonicWall SMA vulnerabilities were CVE-2026-15409 and CVE-2026-15410. They affected the same product and were weaponized as zero-days in June 2026 by a threat actor called UTA0533. The article gives their CVSS scores as 10.0 and 7.2, respectively.

The newer flaw, CVE-2026-102255, is described as a critical pre-authenticated SSRF vulnerability with a CVSS score of 10.0. SonicWall released patches for it on October 6, 2026, and exploitation attempts appeared by October 8. The article does not call this newer flaw a zero-day or describe the same malware deployment.

Attackers using the earlier flaws deployed Java web shells and malware called KNUCKLEBALL. Rapid7 also observed exploitation of those flaws to execute operating-system commands and maintain long-term, persistent access. They extracted credentials, session databases, and TOTP seed configurations before pivoting into internal networks.

Credentials give attackers identities they can use to access systems, while active session databases may contain information tied to users who are already authenticated. TOTP MFA seed configurations are the underlying settings used to generate time-based one-time codes. Stealing all three gives attackers several forms of access material rather than just one password.

The article says attackers systematically extracted high-value credentials, active session databases, and TOTP MFA seed configurations after gaining a foothold on the appliance. It then says they used these harvested resources to shift quickly to lateral movement. The text does not specify which individual accounts or systems were accessed.

The result was a direct pivot from the compromised appliance into the internal corporate network. This made the appliance a launch point for broader intrusion, not merely the final target. The reported behavior also shows why protecting edge devices matters: access material stored or handled there can help attackers bypass normal boundaries and maintain momentum inside an organization.