Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Attackers made 135 attempts to exploit critical pre-auth SSRF CVE-2026-102255 in SonicWall SMA 1000 days after patching.
Threat actors began targeting CVE-2026-102255, a pre-authenticated SSRF (CVSS 10.0) in SonicWall SMA 1000, within days of SonicWall’s October 6, 2026 patches (12.4.3-03670 and 12.5.0-03082). Defused Cyber and Previdian saw the first attempts on October 8; Previdian counts 135 attempts from two U.S. IP addresses. SonicWall has not yet updated its advisory to note exploitation. In June 2026, UTA0533 exploited CVE-2026-15409 and CVE-2026-15410 as zero-days to deploy Java web shells and KNUCKLEBALL, steal credentials, sessions, and TOTP seeds, and move laterally.
- CVE-2026-102255 is a pre-auth SSRF in SonicWall SMA 1000 scored CVSS 10.0.
- SonicWall patched it October 6; exploitation attempts began October 8.
- Previdian logged 135 attempts from two U.S. IP addresses.
- Earlier zero-days CVE-2026-15409 and CVE-2026-15410 were used by UTA0533.
- That campaign deployed KNUCKLEBALL and web shells and stole credentials and MFA seeds.
- ATT&CK
- T1190 Exploit Public-Facing ApplicationT1505.003 Web ShellT1059 Command and Scripting InterpreterT1552.001 Credentials In FilesT1539 Steal Web Session Cookie
- Vendors
- SonicWall
- Products
- SMA 1000
- Threat actors
- UTA0533
- Malware
- KNUCKLEBALL
- Organizations
- Defused CyberPrevidianRapid7
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102255 | Pre-auth SSRF in SonicWall SMA1000 Work Place interface | 10.0 | <1% | PoC ×2 | |
CVE-2026-15409+1 related CVE | Unauthenticated SSRF in SonicWall SMA1000 Appliances | 10.0 group max | 7% | KEVRansomwarePoC | KEV |
From the original article
1 min read at thehackernews.com
Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10. 0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker "to direct the appliance to issue requests on their
thehackernews.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.