Attackers exploit critical SonicWall SMA1000 flaw days after patch

On October 6, SonicWall published an advisory for four vulnerabilities in its SMA1000 series secure access appliances. The most serious, CVE-2026-102255 (CVSS 10.0), is a pre-authentication server-side request forgery bug in the Work Place interface: an unintended alternate access path lets a remote, unauthenticated attacker direct the appliance to send requests on their behalf, reach internal functionality and perform unauthorized operations. SonicWall credits Benoît Sevens of Anthropic with finding it.

The same release fixes an authenticated OS command injection (CVE-2026-102256, CVSS 7.8), also reported by Sevens, a Zip Slip flaw in the management console that can lead to code execution (CVE-2026-102257), and a stored cross-site scripting bug (CVE-2026-102258). Versions 12.4.3-03526 and 12.5.0-02952 and older are affected; fixed releases are 12.4.3-03670 and 12.5.0-03082, and there is no workaround. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected. At publication, SonicWall said it had no evidence of exploitation.

That changed within days. Defused said exploitation attempts reached its SMA decoys on October 8, and Previdian's sensors first recorded attempts consistent with CVE-2026-102255 on October 9. Horizon3.ai warned that successful exploitation could let attackers take over vulnerable devices. The flaw is not yet in CISA's Known Exploited Vulnerabilities catalog.