Critical SonicWall Vulnerability Exploited Days After Disclosure
Attackers began exploiting critical SonicWall SMA1000 SSRF CVE-2026-102255 within two days of its October 6 disclosure.
SonicWall disclosed CVE-2026-102255 on October 6, a pre-authentication server-side request forgery in the SMA1000 Work Place interface with a CVSS score of 10. A remote attacker can make affected 6210, 7210, and 8200v appliances issue requests and reach internal functionality. Patched versions are 12.5.0-03082 and 12.4.3-03670. Previdian and Defused reported exploitation attempts beginning October 8, two days after disclosure, and Horizon3.ai warned successful exploitation could allow device takeover.
- CVE-2026-102255 is pre-auth SSRF in SMA1000, scored CVSS 10.
- Affected models are 6210, 7210, and 8200v.
- Fixed builds are 12.5.0-03082 and 12.4.3-03670.
- Exploitation attempts hit decoys on October 8, two days after disclosure.
- CVEs
- CVE-2026-102255
- Vendors
- SonicWall
- Products
- SMA1000
- Organizations
- PrevidianDefusedHorizon3.ai
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102255 | Pre-auth SSRF in SonicWall SMA1000 Work Place interface | 10.0 | <1% | PoC ×2 |
From the original article
1 min read at securityweek.com
CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations. The post Critical SonicWall Vulnerability Exploited Days After Disclosure appeared first on SecurityWeek.
By Ionut Arghire · securityweek.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.