CriticalZero-DayCVE-2026-102255
Critical SonicWall Vulnerability Exploited in Attacks Following Disclosure
Cyber Security News·Source published ·1 min read
What happened?
A critical SonicWall SMA1000 flaw, CVE-2026-102255 (CVSS 10.0), is being actively exploited days after disclosure, allowing unauthenticated attackers to make vulnerable appliances send requests on their behalf. Threat intelligence firms detected exploitation attempts beginning October 8, two days after SonicWall released fixes. The activity affects SonicWall Secure Mobile Access appliances used to provide remote access to business resources. Defused Cyber reported suspicious traffic against its SMA decoys, while Previdian detected attempts consistent with the same vulnerability.
Key details
- Exploitation attempts were first observed on October 8, two days after SonicWall released fixes.
- Three additional flaws were addressed in the same release, all requiring authenticated access.
- Earlier zero-day attacks on SonicWall SMA1000 used separate SSRF and command injection vulnerabilities.
- SonicWall initially stated there was no evidence of exploitation in the wild at the time of disclosure.
Affected
- SMA1000 models 6210, 7210, and 8200v running 12.4.3-03526 or older, or 12.5.0-02952 or older.
Fixes and mitigations
- Upgrade to 12.4.3-03670 or later, or 12.5.0-03082 or later, using the appropriate software branch.
- SonicWall lists no workaround for the vulnerability.
What to look for
- Defused Cyber observed suspicious traffic against SMA decoys starting October 8.
- Previdian recorded 135 exploitation attempts from two U.S.-based IP addresses.
Summarised by SecOraLens from Cyber Security News. Always read the original source before acting. How SecOraLens verifies advisories.