SonicWall SMA 1000 pre-authentication SSRF flaw now under active exploitation days after patch release

Threat intelligence firms Defused Cyber and Previdian detected active exploitation of CVE-2026-102255, the pre-authentication server-side request forgery flaw rated 10.0 in SonicWall SMA 1000 appliances, starting October 8, two days after SonicWall released patches on October 6. Previdian's telemetry recorded 135 exploitation attempts from two United States IP addresses as of October 12. The flaw lets an unauthenticated attacker make the appliance issue requests on their behalf to reach internal functionality. Fixed builds are 12.4.3-03670 and 12.5.0-03082. As of reporting, SonicWall had not updated its advisory to reflect the active exploitation now underway.

Check

Confirm SonicWall SMA 1000 appliances are patched to 12.4.3-03670 or 12.5.0-03082, and treat any unpatched internet-facing appliance as a priority given active exploitation.

Affected

Unpatched SonicWall SMA 1000 appliances let an unauthenticated attacker make the appliance reach internal functionality, and the flaw is now being exploited in the wild.

Fix

Apply the SonicWall hotfix builds now, restrict management interface exposure, and review appliances for signs of server-side request forgery abuse and unexpected internal requests.