Cybercriminals Rapidly Exploit Critical SonicWall SMA 1000 Weakness After Patch Deployment

Security researchers have identified active attempts to exploit a newly disclosed critical vulnerability affecting SonicWall SMA 1000 appliances, with attackers moving to weaponize the flaw just days after remediation became available.

Tracked as CVE-2026-102255 and assigned the maximum CVSS severity score of 10.0, the flaw is a pre-authentication server-side request forgery (SSRF) vulnerability. Successful exploitation enables a remote, unauthenticated attacker to manipulate the appliance into sending requests on the attacker's behalf, potentially granting access to internal functions and allowing unauthorized actions without valid credentials.

SonicWall addressed the issue on October 6, 2026, releasing fixes in version 12.4.3-03670 (platform hotfix) and version 12.5.0-03082 (platform hotfix). Despite the availability of patches, threat intelligence researchers reported attackers probing and exploiting vulnerable systems within 48 hours of public disclosure.

According to findings from Defused Cyber and Previdian, the earliest exploitation activity was detected on October 8, 2026. Telemetry collected by Previdian has recorded at least 135 exploitation attempts originating from two distinct U.S.-based IP addresses, indicating that adversaries quickly incorporated the vulnerability into their attack operations. At the time of reporting, SonicWall's advisory had not yet been updated to reflect evidence of active exploitation in the wild.

The discovery marks the latest in a series of security incidents involving SonicWall SMA 1000 appliances. Earlier in June 2026, threat actors leveraged two additional vulnerabilities, CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2), as zero-day exploits. Those attacks were attributed to a threat cluster tracked as UTA0533, which used the vulnerabilities to deploy malicious Java-based web shells and a malware family known as KNUCKLEBALL.

Further analysis from Rapid7 revealed that attackers targeted internet-exposed SMA 1000 devices as an initial access vector, enabling them to execute commands directly on affected systems while maintaining stealth and persistence within compromised environments.

Once access was established, operators reportedly harvested sensitive assets, including privileged credentials, active user session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication seed information. Armed with these credentials and authentication artifacts, attackers were able to expand their foothold beyond the appliance itself, moving laterally into internal enterprise networks and increasing the risk of broader network compromise.

The rapid transition from patch release to active exploitation underscores the urgency for organizations running SonicWall SMA 1000 appliances to apply available updates immediately and review systems for indicators of compromise.