CVE-2026-102255: Critical SonicWall SMA1000 SSRF
SonicWall patched critical pre-auth SMA1000 SSRF CVE-2026-102255 after exploitation attempts hit honeypots.
78
Organization
SonicWall
- Mentions · 7d0
- Mentions · 30d5
- All mentions14
- First seenSep 2, 2026
- Last mentioned18d ago
Timeline
14 articles · newest firstMax severity SonicWall SMA1000 flaw now exploited in attacks
Attackers exploit max-severity SonicWall SMA1000 flaw CVE-2026-102255 three days after patch; Previdian honeypots captured matching exploitation attempts.
85
SonicWall security advisory (AV26-1017)
Canada's Cyber Centre warns SonicWall SMA1000 appliances through version 12.5.0 have multiple vulnerabilities and should be updated.
40
SonicWall Patches CVSS 10.0 Pre-Authentication SSRF Flaw in SMA1000 Appliances
SonicWall patched a CVSS 10.0 pre-auth SSRF in SMA1000 WorkPlace plus three authenticated flaws.
74
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall patched pre-auth SSRF CVE-2026-102255 in SMA 1000 appliances, with no known exploitation.
70
InfraTrust report warns network management systems under attack
Active exploitation of critical Cisco and SonicWall management system vulnerabilities is a major trend, with attackers chaining flaws and deploying ransomware.
90
DarkMe RAT trades zero-days for plain phishing emails
The DarkMe RAT has shifted from using zero-day exploits to simple phishing emails, targeting corporate users to steal cryptocurrency and credentials.
55
[object Object]
The DarkMe malware is now being delivered via simple phishing emails, abandoning the zero-days previously used to deliver the payload.
72
UK Council Attack Linked to Mass Exploitation of SonicWall Flaw
Hunt.io links a UK council attack to mass exploitation of SonicWall SMA1000 flaw CVE-2026-15409 (CVSS 10.0), enabling credential and Active Directory theft.
90
Attackers exploit zero-days in consistently besieged SonicWall product
Two actively exploited SonicWall SMA 1000 zero-days chain to unauthenticated RCE; patches released and CISA added both to KEV.
82
CISA Warns of SonicWall SMA1000 Vulnerabilities Active Exploitation (CVE-2026-83548 & CVE-2026-83549)
CISA added two actively exploited SonicWall SMA1000 flaws to KEV: pre-auth SSRF CVE-2026-83548 (CVSS 10) and post-auth RCE CVE-2026-83549; patch by September 5.
82
SonicWall Patches Two New Actively Exploited Zero
SonicWall patches two actively exploited SMA 1000 VPN zero-days: CVSS 10.0 pre-auth SSRF CVE-2026-83548 and post-auth command injection CVE-2026-83549, chained for RCE.
90
CISA Adds Seven Known Exploited Vulnerabilities to Catalog
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA1000 SSRF and command injection flaws.
72
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.
85
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-1541012%7.2Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- Authenticated OS command injection in SonicWall SMA1000
- Zip Slip RCE in SonicWall SMA 1000 AMC
- Stored XSS in SonicWall SMA 1000 Management Console
- CVE-2026-958619%9.3Unauthenticated SQL Injection RCE in Sangoma Switchvox SMB Edition
- CVE-2026-91843<1%9.8Unauthenticated stack overflow gives root RCE in Check Point login process
Appears with
- SonicWallvendor · 10
- CISAorganization · 5
- SMA1000product · 3
- Trend Microorganization · 3
- SonicWall SMA 1000product · 3
- Huntressorganization · 3
- SonicWall SMA1000product · 3
- Rapid7organization · 3
- KNUCKLEBALLmalware · 2
- DarkMemalware · 2
- UTA0533threat actor · 2
- SMA 1000product · 2
- Appliance Management Consoleproduct · 2
- Water Hydrathreat actor · 2
- JFrogvendor · 1
- Cisco Identity Services Engineproduct · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.