SonicWall SMA 1000’s critical SSRF flaw is already being exploited 135 times
SonicWall patched a pre-authentication SSRF (CVE-2026-102255, CVSS 10.0) in its SMA 1000 appliances on 6 October 2026; since 8 October, researchers have logged 135 exploitation attempts. If you run an internet-facing SMA 1000, apply hotfix 12.4.3-03670 or 12.5.0-03082 and hunt for web shells.
6 October 2026. SonicWall ships hotfixes for a flaw in its SMA 1000 line. 8 October 2026. The firms Defused Cyber and Previdian log the first exploitation attempts. 12 October 2026. Previdian counts 135 attempts originating from two unique IP addresses in the United States. Why it matters: an internet-facing VPN appliance is an ideal entry point, and this one is already under attack.
A pre-authentication SSRF rated 10.0
The vulnerability, tracked as CVE-2026-102255, carries a CVSS score of 10.0, the top of the scale. It is a pre-authentication server-side request forgery (SSRF) that lets a remote attacker “direct the appliance to issue requests on their behalf, reach internal functionality and perform unauthorized operations.” In plain terms: no login required, and no exotic exploit — just convince the box to query its own internal surface.
SSRF is a fearsome class of bug on edge devices. Where SQL injection hits an application, SSRF hits the infrastructure itself: the device becomes a relay, a way to bounce into services that are never meant to be exposed. On a VPN or remote-access gateway, the impact is measured less in stolen data than in a full pivot into the internal network.
SonicWall shipped the fixes on 6 October 2026 as two platform hotfixes: 12.4.3-03670 and 12.5.0-03082. They close the hole before public exploitation even began. The problem, then, is not a silent vendor — it is the speed of patching on appliances that are, by nature, rarely updated under pressure.
Two days between the patch and the first exploit
The gap is the striking fact of the story. Patch on 6 October, first attempts on 8 October: two days. Defused Cyber and Previdian spotted the activity almost immediately, and Previdian published a precise count — 135 attempts to date, from two unique US IP addresses. A modest volume, but an unambiguous signal: exploit code is circulating, and actors are testing it.
A two-day turnaround is no anomaly in 2026. The cycle of “patch release, reverse engineering, exploitation” has compressed to the point where an appliance left unpatched at the end of the week is already a target at the start of the next. For a CISO, the consequence is mechanical: the window between patch and attack is now shorter than most scheduled maintenance cycles.
At the time of writing, SonicWall has not yet updated its advisory to reflect active exploitation. That detail matters: dashboards that only track vendor advisories, without cross-referencing external intelligence, risk filing this flaw as “patched and unexploited” while it is being actively targeted.
An appliance family already hit in June
The SMA 1000 is no stranger to alerts. In June 2026, two other flaws in the same product — CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) — were exploited as zero-days by an actor dubbed UTA0533, which deployed Java web shells and an implant called KNUCKLEBALL. That campaign was widely documented, and it casts the current one in a particular light: attackers treat these appliances as a recurring target class, not a one-off incident.
Rapid7 detailed June’s playbook, and it is instructive. Once a foothold is gained on an exposed device, the actors methodically extract high-value material: credentials, active session databases, and the TOTP seed configurations behind multifactor authentication (MFA). In other words, they do not just get in — they harvest what lets them get back in later, even after passwords rotate, because TOTP seeds let them recompute one-time codes on demand.
With those resources, the rest is textbook lateral movement: “pivoting from the compromised appliance directly into the internal corporate network.” A SMA 1000 is a remote-access gateway, so it concentrates exactly what an attacker wants: the boundary, the sessions, and the authentication secrets.
What the appliance exposes beyond the flaw itself
The case illustrates a broader truth: a VPN or remote-access gateway is a high-value asset because it stacks three unfavourable properties. It is internet-facing by definition. It is rich in secrets: passwords, sessions, MFA seeds. And it is often neglected: installed once, patched only reluctantly, because maintenance means an access outage for users.
CVE-2026-102255 adds a layer to that picture: an SSRF on this kind of box does not read like a local privilege escalation. It turns the appliance into a network pivot from the very first phase, before the attacker has even stolen a single credential. That is what separates this alert from an ordinary application vulnerability.
For teams running these appliances, June’s lesson should shape today’s response: do not stop at patching — look for evidence of a compromise already in progress. A patch does not evict a web shell that is already installed, and it does not rotate TOTP seeds that have already been stolen.
Patch first, then hunt for the traces
Patching is not enough, because a two-day window means an unpatched appliance may have been compromised before the fix was applied. The recommended sequence starts with confirming the version actually running: the hotfix 12.4.3-03670 or 12.5.0-03082 must appear in the management console, not merely in the download list. A device still reporting an earlier version is not protected, whatever the state of the update queue.
Then comes the hunt for traces. June’s campaigns showed attackers dropping web shells and exfiltrating TOTP seeds; a recently targeted appliance deserves inspection. Look for files modified after 6 October, unusual processes, and accounts created outside procedure. Rotating TOTP seeds is not optional: it is the only way to invalidate one-time codes the attackers may have copied, and it is something the patch does not do for you.
Finally, telemetry matters. Previdian’s count — 135 attempts from two US IPs — describes an initial sweep, not a mass campaign. That is the classic profile of actors testing a freshly published exploit against a pool of exposed appliances. Read it as an early signal: the volume is still low because exploitation has just begun, not because it is contained.
For a team still weighing whether an exposed gateway justifies out-of-band patching, the telemetry settles the argument. A gateway treated as network hardware rather than as a server — patched on a quarterly or ad-hoc schedule — now lags the adversary by definition, and the two-day gap shows how little margin that leaves. The defensible posture is to move internet-facing appliances into the same out-of-band change process as critical servers, with a target measured in hours rather than weeks. The patch already exists; the remaining variable is your update cadence.
Verdict
If you expose an SMA 1000 to the internet, apply hotfix 12.4.3-03670 or 12.5.0-03082 for your branch immediately — do not wait for a maintenance window: attackers need two days, so your window must be shorter. Right after that, treat the appliance as potentially compromised: inspect it for web shells, revoke and regenerate TOTP seeds, and force re-authentication of active sessions. If you manage a fleet, cross-reference the SonicWall advisory with external telemetry (Previdian, Rapid7) before closing the finding: a vendor advisory that has not been updated does not mean exploitation is not happening.