Critical SonicWall Vulnerability Exploited Days After Disclosure

Attackers have begun targeting a maximum-severity flaw in SonicWall SMA1000 appliances just days after the vendor released a fix. The bug, CVE-2026-102255 (CVSS 10), is a pre-authentication server-side request forgery issue in the SMA1000 Work Place interface that lets an unauthenticated remote attacker trick the device into making requests on its behalf, exposing internal functionality to unauthorized use. SonicWall disclosed the flaw on October 6 and told customers running the 6210, 7210, and 8200v models to upgrade to firmware 12.5.0-03082 or 12.4.3-03670. Threat intel firms Previdian and Defused reported seeing the first exploitation attempts against honeypot sensors as early as October 8, while Horizon3.ai cautioned that successful attacks could lead to full device takeover.