Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
86
Product
SMA 1000
- Mentions · 7d0
- Mentions · 30d5
- All mentions11
- First seenSep 2, 2026
- Last mentioned18d ago
Timeline
11 articles · newest firstSonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 pre-auth SSRF CVE-2026-102255, a CVSS 10.0 flaw with no workaround.
88
Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
84
SonicWall Patches 4 SMA1000 Flaws, Including Critical Pre-Auth SSRF Rated CVSS 10
SonicWall patched four SMA 1000 flaws, including an unauthenticated SSRF rated CVSS 10.0.
68
SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
SonicWall patched pre-auth SSRF CVE-2026-102255 in SMA 1000 appliances, with no known exploitation.
70
7th September – Threat Intelligence Report
Check Point weekly bulletin: exploited SonicWall SMA 1000 zero-days (CVE-2026-83548/49), JFrog Artifactory auth bypass, and a 2.8M-patient Baylor Genetics breach.
70
CISA Adds Seven Exploited Flaws as Attackers Deploy Reverse Shells and Crypto Miners
CISA added seven actively exploited vulnerabilities to its KEV catalog, including SonicWall SMA 1000 SSRF CVE-2026-83548, amid campaigns deploying reverse shells and crypto miners.
85
SonicWall SMA 1000 Zero-Days Enable Unauthenticated RCE
New SonicWall SMA 1000 zero-days enable unauthenticated remote code execution, with exploitation observed following earlier summer attacks on other SonicWall edge zero-days.
78
SonicWall's SMA1000 boxes under active attack again
SonicWall warns attackers are chaining two SMA1000 zero-days, a CVSS 10.0 SSRF and command injection, to compromise VPN gateways.
78
Attackers Exploit Two SonicWall SMA 1000 Zero-Days That May Form an Attack Chain
SonicWall patches two actively exploited zero-days (CVE-2026-83548, CVE-2026-83549) in SMA 1000 VPN appliances, likely chained for code execution.
85
SonicWall SMA 1000 appliances under attack via zero-day flaws
SonicWall confirms active exploitation of zero-day SSRF (CVE-2026-83548) and command injection (CVE-2026-83549) flaws in SMA 1000 remote access appliances.
80
Related CVEs
by mentions- CVE-2026-835488%10.0Pre-Authentication SSRF in SonicWall SMA1000 Appliance Workplace Interface
- CVE-2026-8354910%7.8Authenticated OS Command Injection RCE in SonicWall SMA1000 Appliance Console
- CVE-2026-102255<1%10.0Pre-auth SSRF in SonicWall SMA1000 Work Place interface
- CVE-2026-154097%10.0Unauthenticated SSRF in SonicWall SMA1000 Appliances
- CVE-2026-8232914%9.8Improper Authentication in JFrog Artifactory Allows Unauthenticated Admin Access
- CVE-2026-1541012%7.2Authenticated OS Command Injection in SonicWall SMA 1000 Appliance Management Console
- Authenticated OS command injection in SonicWall SMA1000
- Zip Slip RCE in SonicWall SMA 1000 AMC
- Stored XSS in SonicWall SMA 1000 Management Console
- CVE-2026-4227191%8.7Command Injection in BerriAI LiteLLM AI Gateway Exploited in the Wild
Appears with
- SonicWallvendor · 11
- Previdianorganization · 3
- CISAorganization · 2
- UTA0533threat actor · 2
- Defusedorganization · 2
- Artifactoryproduct · 2
- SonicWallorganization · 2
- JFrogvendor · 2
- KNUCKLEBALLmalware · 2
- Secure Mobile Accessproduct · 2
- FBIorganization · 1
- NodeRabbitmalware · 1
- Anthropicorganization · 1
- WorkPlaceproduct · 1
- NHS Englandorganization · 1
- Kestravendor · 1
Entities are extracted by the model from each article. First seen , last mentioned . Watching keeps it in this browser only (no account); the watchlist page and dashboard alerts use it.