Overview
- SonicWall disclosed and released hotfixes for CVE-2026-102255 on Tuesday, October 6, urging users to update affected SMA1000 models to fixed platform versions.
- Security firms detected exploitation attempts beginning two days later on Thursday, October 8, showing attackers moved quickly once the flaw was public.
- Previdian has recorded 135 attack attempts so far originating from two U.S.-based IP addresses, while Defused observed similar unauthenticated SSRF traffic against its SMA decoys.
- Researchers warn successful exploitation can let attackers take over appliances, extract credentials and TOTP seeds, and use compromised devices to pivot into corporate networks.
- Organizations should apply SonicWall hotfixes, tighten network controls for internet-facing appliances, and monitor for signs of compromise because these devices are high-value initial-access targets.