Critical Sonic Wall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Summary: A pre-authenticated server-side request forgery flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 with a CVSS score of 10.0, was patched on October 6, 2026 in versions 12.4.3-03670 and 12.5.0-03082. Defused Cyber and Previdian detected exploitation attempts beginning October 8, 2026, and Previdian data shows 135 attempts from two unique IP addresses in the U.S.
What you should know: This is the third SonicWall SMA 1000 flaw to be exploited in months: in June 2026, UTA0533 weaponized CVE-2026-15409 and CVE-2026-15410 to deploy Java web shells and KNUCKLEBALL, then pulled credentials, session databases, and TOTP MFA seeds off the appliance and pivoted into internal networks.

Read the original at The Hacker News ↗

Topics: Vulnerabilities & Patching
Mentions: CVE-2026-102255 CVE-2026-15409 CVE-2026-15410
Related: Sonic Wall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances Cyber Risks ·
INC Ransomware Emerges as Dominant Actor Exploiting Sonic Wall SMA 1000 Flaws Cyber Risks ·
Attackers Exploit Two Sonic Wall SMA 1000 Zero-Days That May Form an Attack Chain Cyber Risks ·