SonicWall SMA1000 Flaw CVE-2026-102255 Exploited Days After Patch

What happened

Attackers are already going after a maximum-severity vulnerability in SonicWall's SMA1000 secure remote access appliances. SonicWall released the fix only three days before exploitation activity was reported 1. The flaw, tracked as CVE-2026-102255, sits in the Appliance WorkPlace interface of the SMA1000 6210, 7210, and 8200v models 1.

SonicWall says the bug does not affect its SMA 100 Series or the SSL-VPN feature built into its firewalls 1. That narrows the blast radius, but the affected SMA1000 line is the enterprise-grade tier, which organizations use to broker remote access into internal networks.

SonicWall describes the issue as a path that lets a remote, unauthenticated attacker make the appliance send requests on the attacker's behalf. Those requests can reach internal functionality and carry out unauthorized operations 1. In practice, that is a server-side request forgery pattern. The appliance becomes a proxy into places the attacker shouldn't be able to reach.

Exploitation came from outside, not the vendor

SonicWall did not flag the vulnerability as actively exploited when it published its advisory on Tuesday 1. The first warning came from Ryan Dewhurst, founder of Previdian, who said on Friday that his company's honeypot network had picked up exploitation attempts consistent with CVE-2026-102255 1.

This turnaround is fast, but it is not unusual. Once a patch ships, attackers can compare fixed and unfixed builds to work out what changed and build an exploit. Organizations that wait for a weekly or monthly maintenance window give attackers time to get there first. The gap here was roughly 72 hours. That is a strong argument for treating edge-appliance advisories as emergency changes rather than routine ones.

The framing also needs some care. Based on the reported timeline, the activity Previdian observed began after the patch was available 1. Strictly speaking, that makes this a rapidly weaponized "n-day" rather than a classic zero-day exploited before disclosure. For defenders, the distinction matters less than the result: unpatched appliances are being probed now.

How many devices are at risk?

Shadowserver, the internet threat-monitoring group, currently tracks more than 400 SMA1000 appliances reachable online 1. That figure needs context. It is unclear how many of those systems are honeypots and how many have already been patched 1. The true number of vulnerable production devices could therefore be meaningfully lower.

Even so, a few hundred internet-facing remote access gateways is a valuable target set. Each one sits at the boundary of a corporate network.

Part of a recurring SMA1000 problem

This is not the first time this year that SMA1000 customers have scrambled. Integrity360's threat advisory feed separately records SonicWall issuing emergency updates for two SMA1000 vulnerabilities after confirming evidence of active exploitation 2. The available details do not state exactly when that advisory landed relative to CVE-2026-102255. Taken together, though, they point to a product line that attackers keep targeting.

The wider edge-device pattern

SonicWall is in crowded company. The same advisory feed lists Citrix emergency patches for two critical NetScaler remote code execution flaws, CVE-2026-88771 and CVE-2026-88772, both exploited as zero-days 2. It also records Cisco confirming active exploitation of CVE-2026-20079, a critical authentication bypass in Secure Firewall Management Center 2. A critical SAP Cloud Application Programming Model flaw, CVE-2026-76969, involving unauthenticated credential disclosure and tenant data manipulation, appears alongside them 2.

The common thread is clear. VPN concentrators, application delivery controllers, and firewall management consoles remain among the most attractive entry points for attackers. They are exposed to the internet by design and are trusted by the networks behind them. They also often run firmware that defenders cannot easily inspect or instrument.

What to do

The guidance is simple. SMA1000 6210, 7210, and 8200v owners should apply SonicWall's update immediately 1. Ideally, they should also review logs from the past several days for unusual outbound or internal requests coming from the appliance, given the SSRF-style nature of the bug. Where possible, restricting access to the WorkPlace interface would reduce exposure while patching is completed.

The broader point is that vendor "not exploited" status at disclosure is a snapshot, not a guarantee. Here, independent honeypot data overtook the vendor's own advisory within days 1. Security teams that tie their response urgency to that initial label are likely to fall behind.