SonicWall SMA1000 Flaw Rated Perfect 10 Is Already Under Attack
A critical security hole in SonicWall's remote-access appliances was being exploited within 48 hours of the public fix. What that means and what to do now.
Key points
- Attackers hit live SonicWall SMA1000 devices on October 8, 2026, just two days after SonicWall published the patch.
- CVE-2026-102255 carries a CVSS score of 10 out of 10, the highest possible severity rating.
- The flaw requires no login to exploit, meaning anyone on the internet could attempt an attack without stealing a password first.
- Affected models are the 6210 and 7210, plus the 8200v; fixed software versions are 12.5.0-03082 and 12.4.3-03670.
- Threat intelligence firms Previdian and Defused both independently observed exploitation attempts in the wild.
SonicWall SMA1000 appliances are remote-access gateways: the devices companies use to let employees connect securely to their office networks from home or while travelling. Break one open and you can reach everything it protects.
That's the scenario defenders are now racing to prevent.
What is the actual flaw?
The vulnerability is a pre-authentication SSRF (server-side request forgery) flaw. "Pre-authentication" means no password is needed. "SSRF" means an attacker can trick the appliance into making network requests on the attacker's behalf, reaching internal systems that should be off-limits.
An outsider sends a specially crafted message to the appliance's Work Place web interface. The device then makes requests to internal systems it should never touch, and the attacker rides that connection to reach sensitive functionality behind the firewall. SonicWall's own disclosure describes the root cause as "an unintended alternate access path" in that interface. Horizon3.ai has warned that successful exploitation can lead to full device takeover.
This is the fourth SMA1000 story we've covered in the last 90 days, going back to a July hotfix that was already being abused when it shipped. The pattern is consistent: these gateways attract attackers fast.
How fast did attackers move?
Very fast. SonicWall disclosed the bug on October 6. Defused, a threat intelligence company that runs decoy devices designed to attract attacks, recorded the first exploitation attempts against its SMA1000 honeypots on October 8. Two days.
Previdian (formerly KEVIntel) also confirmed hits on its own sensor network, citing activity "consistent with CVE-2026-102255." Both firms reported these findings publicly on the Friday following disclosure, as SecurityWeek first reported.
Forty-eight hours between patch and active exploitation is short even by recent standards. Whoever ran the first scans either had the exploit ready before the patch dropped, or reverse-engineered the fix almost immediately.
| Detail | Information |
|---|---|
| CVE ID | CVE-2026-102255 |
| CVSS Score | 10.0 (Critical) |
| Disclosure date | October 6, 2026 |
| First exploitation observed | October 8, 2026 |
| Affected models | SMA 6210, 7210, 8200v |
| Fixed versions | 12.5.0-03082 and 12.4.3-03670 |
Should IT teams be worried?
Yes, especially any organisation still running an unpatched SMA1000. The fix is available now.
If you manage one of these appliances, update to 12.5.0-03082 or 12.4.3-03670 immediately, then review access logs for unusual outbound requests from the appliance dating back to at least October 6. A device that was internet-facing and unpatched during that window should be treated as potentially compromised until logs say otherwise.
For everyone else: if your employer uses a SonicWall remote-access product, the practical risk depends entirely on whether your IT team has applied the patch. A compromised gateway could expose internal systems, which in turn could expose employee data or business records. Worth asking about.
