ai-security EN

Critical SonicWall Vulnerability Exploited Days After Disclosure

• Source: securityweek.com • Feed: feeds.feedburner.com

Vulnerabilities

Critical SonicWall Vulnerability Exploited Days After Disclosure

CVE-2026-102255 is a pre-authenticated SSRF flaw that could allow attackers to perform unauthorized operations.

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

By

Ionut Arghire

|

October 12, 2026 (4:36 AM ET)

SonicWall vulnerability

Threat actors started exploiting a recently patched critical vulnerability in SonicWall SMA1000 appliances within days after public disclosure.

Tracked as CVE-2026-102255 (CVSS score of 10), the security defect is described as a pre-authenticated server-side request forgery (SSRF) issue affecting the SMA1000 Work Place interface.

According to SonicWall, an unintended alternate access path could allow a remote attacker “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”

The company disclosed CVE-2026-102255 on October 6, urging customers to update their 6210, 7210, and 8200v models to software versions 12.5.0-03082 and 12.4.3-03670.

On Friday, threat intelligence firms Previdian (formerly KEVIntel) and Defused warned of the first exploitation attempts targeting the security bug.

Defused said that the first exploitation attempts reached its SMA decoys on October 8, only two days after public disclosure.

Advertisement. Scroll to continue reading.

“SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0). The vulnerability allows unauthenticated server-side request forgery (SSRF),” Previdian said.

Successful exploitation of the flaw could allow attackers to take over vulnerable devices, cybersecurity firm Horizon3.ai warned .

Related: Unpatched AhsayCBS Vulnerabilities Exploited in the Wild

Related: Citrix Urges Immediate Patching of Critical NetScaler Vulnerability

Related: Cisco Patches a Dozen Critical Vulnerabilities

Related: Attackers Target Critical Atlassian Vulnerability Within Hours of PoC Publication

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

Written By

Ionut Arghire

Ionut Arghire is an international correspondent for SecurityWeek.

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing for the latest cybersecurity threats, trends, and expert insights.

More from Ionut Arghire

Latest News

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

Ransomware Response Expert Arrested in ShinyHunters FBI Hack Probe

Critical SonicWall Vulnerability Exploited Days After Disclosure

Insider Cyber Extortion Plot Against Industrial Firm Lands Engineer in Prison

iRhythm Data Breach Impacts at Least 360,000 People

Mastermind of 15,000-Mule Cybercrime Laundering Network Pleads Guilty in US

Security Awareness Training Isn’t Dead, but It Needs a Rethink

Canonical Websites Disrupted in Second DDoS Attack This Year

Bricksforge WordPress Plugin Vulnerability Exploited in the Wild

Daily Briefing Newsletter

Subscribe to the SecurityWeek Email Briefing to stay informed on the latest threats, trends, and technology, along with insightful columns from industry experts.

## Webinar: AI Is Accelerating Risk. Can Your IT Operations Keep Up?

October 14, 2026

Learn about Frontier Pace Governance: a practical approach to helping IT operations move at AI speed without sacrificing security, accountability, or operational discipline.

Register

## Virtual Event: Zero Trust & Identity Strategies Summit 2026

October 14, 2026

Join as we decipher the world of zero trust and share war stories on securing an organization by eliminating implicit trust and continuously validating every stage of a digital interaction.

Register

People on the Move

Rapid7 has named Rik Ferguson as VP of Security Intelligence.

Cytactic has appointed Tim Brown as CSO.

Scott Simkin has joined Vega as CMO.

More People On The Move

Expert Insights

## AI Has Changed Attack Speed, Not Security Fundamentals

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

As AI accelerates vulnerability discovery and exploitation, so-called virtual patching still comes down to defense-in-depth and strong application security fundamentals. (Joshua Goldfarb)

## Four Cyber Threats Harboring Big Plans for the Future

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

  • AI, supply-chain exposure, quantum computing and geopolitical conflict are testing security programs. Preparing for disruption must become part of day-to-day operations. (Steve Durbin)

## Begin at the End: How to Enable Agentic Remediation

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

Agentic remediation is not an act of faith. We are talking about fixing known problems, not judgment calls about unfamiliar risk. (Nadir Izrael)

## “We Think the Security Control Is Working” Is No Longer Good Enough

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

Point-in-time audits and sampled assessments offer only snapshots; continuous control monitoring provides evidence that security controls are working today. (Sravish Sridhar)

## This Key Will Self-Destruct: An Open Standard for Revocable API Keys

Critical SonicWall Vulnerability Exploited Days After Disclosure illustration

Every leaked credential should be dead, or dying, within sixty seconds of being found. Here’s a proposal to make that the default. (Matt Honea)

SecurityWeek

Security Community

Stay Intouch

About SecurityWeek

News Tips

Got a confidential news tip? We want to hear from you.

Submit Tip

Advertising

Reach a large audience of enterprise cybersecurity professionals

Contact Us

Daily Briefing Newsletter

Subscribe to the SecurityWeek Daily Briefing and get the latest content delivered to your inbox.

Copyright © 2026 SecurityWeek ®, a Wired Business Media Publication. All Rights Reserved.