Critical CVSS 10 SonicWall SMA1000 Flaw Exploited; Patch Available
SonicWall disclosed CVE-2026-102255 on October 6, a pre-authenticated SSRF flaw scoring CVSS 10 in the SMA1000 Work Place interface. Defused recorded the first exploitation attempts on October 8, two days after disclosure, and The Hacker News reports 135 attempts after the patch. Update models 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082 and check for signs of compromise.
What happened
SonicWall disclosed CVE-2026-102255 on October 6, a maximum severity flaw (CVSS 10) in SMA1000 remote access appliances. Attackers began exploiting it two days after disclosure, and threat intelligence firms report ongoing attempts even after the fix. Patched versions are available.
Why it matters
The SMA1000 provides remote access to the corporate network. According to Horizon3.ai, successful exploitation could let attackers take over the devices, and SonicWall warns of unauthorized operations on internal systems. Unpatched appliances remain exposed.
What to do
Immediately update models 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082. Then check the appliances for signs of compromise.
For the technical team
- CVE
- CVE-2026-102255
- Affected
- SonicWall SMA1000 (modelos 6210, 7210, 8200v) · SonicWall SMA1000 models 6210, 7210 and 8200v before 12.4.3-03670 / 12.5.0-03082.
- Exploitation
- Exploitation reported. Defused recorded the first attempts on its SMA decoys on October 8, two days after disclosure. Previdian (formerly KEVIntel) observes attempts on its sensors consistent with CVE-2026-102255. The Hacker News reports 135 attempts after the patch.
- Fix
- Update to 12.4.3-03670 or 12.5.0-03082.
- Vector
- Pre-authenticated SSRF in the SMA1000 Work Place interface. SonicWall describes an unintended alternate access path that lets a remote attacker direct the appliance to issue requests on their behalf, reach internal functionality and perform unauthorized operations. Exploitable without authentication.
- More details
- CVE-2026-102255, CVSS 10. Disclosed by SonicWall on October 6, 2026. Horizon3.ai assesses that successful exploitation could allow attackers to take over vulnerable devices. NHS England alert: CC-4863.
Timeline
Reports show active exploitation after disclosure and patch release.
Sources 4 sources
- SonicWall Releases Critical Security Advisory for SMA1000 Series Appliances (CC-4863) NHS England Digital
- Critical SonicWall Vulnerability Exploited Days After Disclosure SecurityWeek
- Max severity SonicWall SMA1000 flaw now exploited in attacks BleepingComputer
- Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch The Hacker News
