"to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." — SonicWall
CVE-2026-102255: a pre-authenticated SSRF rated CVSS 10.0
The flaw tracked as CVE-2026-102255 is a pre‑authenticated server‑side request forgery (SSRF) in SonicWall Secure Mobile Access (SMA) 1000 appliances. SonicWall described the impact as allowing a remote attacker "to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." The vulnerability carries a maximum CVSS score of 10.0.
SonicWall published patches for the defect on October 6, 2026, releasing platform hotfixes 12.4.3-03670 and 12.5.0-03082. Those fixes are the vendor's formal remediation for affected SMA 1000 deployments.
Exploit activity detected within days — timeline and telemetry
Public reporting and threat intelligence show exploitation attempts began almost immediately after the patch. Defused Cyber and Previdian detected the first signs of active targeting on October 8, 2026 — two days after SonicWall issued the hotfixes. Previdian's data shows 135 exploitation attempts to date, originating from two unique IP addresses located in the U.S.
Despite those detection claims, SonicWall had not updated its advisory to acknowledge active exploitation as of the most recent reporting in the source material.
This site is the portfolio.
OSINTSights runs on Cloudflare Workers, D1, R2, and Vectorize, with an AI pipeline on Hetzner ARM. Nubivance designed, built, and operates it. We do the same for clients.
See what we buildObserved attacker behavior and the risk to networks
Security vendor Rapid7 tied the class of SMA 1000 flaws to techniques that go beyond service disruption. Rapid7 said actors leveraged similar vulnerabilities to target internet‑facing devices and use them as "a stealthy initial access vector to execute commands on the operating system and ensure long‑term, persistent access."
According to Rapid7, once a foothold was established on a compromised appliance, attackers "systematically extracted high‑value credentials, active session databases, and Time‑Based One‑Time Password (TOTP) multi‑factor authentication (MFA) seed configurations." With those harvested resources, Rapid7 added, the actors "quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network."
Context: prior SMA 1000 weaponization in June 2026
CVE-2026-102255 is the latest in a string of critical issues affecting the SMA 1000 line. In June 2026 two other vulnerabilities in the same product — CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) — were weaponized as zero‑days by a threat actor identified as UTA0533. Those earlier exploits were used to deploy Java web shells and a malware family named KNUCKLEBALL.
The June activity demonstrates a playbook: internet‑exposed appliances are targeted for persistent access, credential and session theft, and subsequent lateral movement into corporate networks. The recent CVE-2026-102255 detections follow that same risk pattern.
What this means for technologists, affected enterprises, and adversaries
- Technologists and security teams: apply the SonicWall platform hotfixes 12.4.3-03670 or 12.5.0-03082 immediately where SMA 1000 appliances are in use, and monitor for the specific indicators reported by Previdian and Defused Cyber; investigate any successful or suspected exploit attempts given the rapidity of observed activity.
- Affected enterprises and procurement leaders: reassess exposure of internet‑facing SMA 1000 appliances and confirm patch deployment; prioritize post‑compromise detection capabilities for credential and TOTP seed exfiltration given Rapid7's documented sequence of attacker actions following appliance compromise.
- Adversaries and threat actors: the rapid detection timeline and earlier weaponization by UTA0533 indicate attackers will continue to treat SMA 1000 appliances as high‑value initial access points, using SSRF and related vectors to escalate into internal networks.
The facts in this case are tightly linked: a maximum‑severity SSRF (CVE-2026-102255), vendor hotfixes on October 6, active detection two days later, 135 observed attempts from two U.S. IPs, and an established exploitation pattern from prior June 2026 attacks that led to credential theft and lateral movement. Whether SonicWall will revise its advisory to reflect ongoing exploitation remains an open, actionable question for defenders already racing to install the released hotfixes.
