SonicWall fixed a 10.0 flaw on 6 October. Attackers came knocking two days later.

By Lior AharonovFounder, 7IT Solutions · 12 October 2026

What happened

SonicWall disclosed CVE-2026-102255 on Tuesday 6 October 2026, a pre-authentication SSRF flaw rated CVSS 10 in the SMA1000 Work Place interface of the 6210, 7210 and 8200v. SecurityWeek reported on 12 October that Defused saw the first exploitation attempts on its decoys on 8 October. The fixed versions are 12.4.3-03670 and 12.5.0-03082.

Why it matters

Your remote access gateway sits in front of the network your team logs into. This flaw lets an outsider make the appliance send requests on their behalf and reach internal functionality. Two days from patch to probing: that is the clock you are on.

What to do

If you run an SMA1000 6210, 7210 or 8200v, upgrade to 12.4.3-03670 or 12.5.0-03082 today, then review the appliance logs since 6 October for unusual requests to the Work Place interface.

Same appliance, same kind of bug, third time this year. I would patch tonight and read the logs all week.

Lior Aharonov · my take

Sources

SecurityWeek: Critical SonicWall Vulnerability Exploited Days After Disclosure securityweek.com
BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks bleepingcomputer.com

securitysonicwallvpnexploitedpatching

Researched with AI tools; every fact is checked against the linked sources.