Security firm Previdian says its sensors recorded exploitation attempts against SonicWall SMA1000 appliances starting October 9, three days after SonicWall published its advisory for CVE-2026-102255 on October 6.
SonicWall’s advisory SNWLID-2026-0017 describes a pre-authentication server-side request forgery (SSRF) flaw in the SMA1000 Appliance Work Place interface, caused by an unintended alternate access path. A remote unauthenticated attacker could potentially direct the appliance to issue requests on their behalf, reach internal functionality and perform unauthorized operations. Previdian lists the CVSS score as 10.0 and, in its vulnerability report, lists affected builds as 12.4.3-03526 (platform-hotfix) and older, and 12.5.0-02952 (platform-hotfix) and older, and rates the attack as remote, low complexity, with no privileges and no user interaction.
Previdian reports its first exploitation observation on October 9 and its last on October 10, and confirmed the exploitation verdict from its honeypot sensors. As of its page, the CVE was not listed in CISA’s Known Exploited Vulnerabilities catalog. The advisory is the place to confirm the fixed build for each model.
An unauthenticated flaw on a remote access appliance saw attack attempts within three days of publication, which leaves little room for a monthly maintenance cycle. In our reading, teams should treat a maximum-severity advisory for an edge device as a same-day task, with the first step being a check of whether the management and user portals face the Internet. We made a similar argument about replacing an exploited edge appliance before trusting it again, and CISA’s listing of a NetScaler flaw as known exploited shows how quickly that status can follow. SonicWall’s SMA line also featured in our coverage of its second SMA zero-day pair.
Source: SonicWall PSIRT
