A critical security vulnerability affecting SonicWall's Secure Mobile Access (SMA) 1000 appliances attracted 135 exploitation attempts, highlighting the risks facing enterprise remote-access infrastructure. Threat intelligence firm Previdian recorded the attempts from two unique IP addresses in the United States. Researchers first detected the activity on October 8, just two days after SonicWall disclosed the vulnerability and released security patches.
The vulnerability, tracked as CVE-2026-102255, carries a Common Vulnerability Scoring System (CVSS) score of 10.0 out of 10. It involves a pre-authentication server-side request forgery (SSRF) flaw in the SMA 1000 Appliance WorkPlace interface.
The weakness could allow remote attackers to make vulnerable appliances send requests on their behalf without authentication. This could expose internal functionality and enable unauthorized operations, potentially putting enterprise networks at risk.
SonicWall identified the SMA 6210, SMA 7210 and SMA 8200v appliances as affected products. The vulnerability impacts firmware versions 12.4.3-03526 and earlier, as well as 12.5.0-02952 and earlier. The company released fixes on October 6, 2026. It recommends that administrators upgrade to version 12.4.3-03670 or later, or 12.5.0-03082 or later, depending on their deployment.
Threat intelligence firms Defused Cyber and Previdian identified the first signs of exploitation on October 8. The 135 attempts indicate that attackers began probing the vulnerability shortly after its disclosure. However, the reported activity does not confirm that attackers successfully compromised any devices.
The latest incident also follows earlier attacks against SonicWall SMA 1000 appliances. In June 2026, threat actors reportedly exploited two other vulnerabilities, CVE-2026-15409 and CVE-2026-15410, to deploy Java web shells and KNUCKLEBALL malware. Although the observed attempts do not establish a confirmed breach, organizations should treat the vulnerability as a high-priority security risk.
Also Read: du Tech, Rilian Partner to Boost Sovereign AI Cybersecurity in UAE