Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch

Attackers have begun probing a maximum-severity SonicWall Secure Mobile Access (SMA) 1000 vulnerability just days after it was publicly disclosed and patched. The flaw, CVE-2026-102255 (CVSS 10.0), is a pre-authentication SSRF bug that lets an unauthenticated remote attacker force the appliance to make requests on their behalf, reaching internal services and performing unauthorized actions. SonicWall shipped fixes on October 6, 2026 via hotfix builds 12.4.3-03670 and 12.5.0-03082, but threat-intel firms Defused Cyber and Previdian spotted exploitation attempts starting October 8, with Previdian logging 135 attempts from two US-based IP addresses; SonicWall's advisory has not yet been updated to confirm active exploitation. This follows an earlier wave of zero-day attacks in June 2026 against the same product line, tracked as CVE-2026-15409 and CVE-2026-15410, which a group called UTA0533 used to deploy web shells and the KNUCKLEBALL malware, with Rapid7 reporting that compromised appliances were used to steal credentials, session data, and MFA seeds before pivoting into internal networks.