securityweek.comarticleCritical SonicWall Vulnerability Exploited Days After Disclosure
SecurityWeek reports that CVE-2026-102255, a CVSS 10 pre-authenticated SSRF in the SonicWall SMA1000 Work Place interface, was exploited within days of its October 6 disclosure. Defused saw the first attempts on its SMA decoys on October 8, and Previdian (formerly KEVIntel) also observed exploitation. SonicWall urges 6210, 7210 and 8200v customers to update to 12.5.0-03082 or 12.4.3-03670, and Horizon3.ai warns that exploitation could lead to device takeover.
TL;DR Critical SonicWall SMA1000 pre-auth SSRF (CVE-2026-102255, CVSS 10) was exploited in the wild two days after disclosure; patch to 12.5.0-03082 or 12.4.3-03670.
Organisations named here
- CWE-918
- Defused
- Previdian
CVEs named here
- CVE-2026-102255
Technologies named here
- Previdian
- SonicWall SMA1000 appliances, Work Place interface
- Defused
- SonicWall SMA1000 6210
- SonicWall SMA1000 7210
- SonicWall SMA1000 8200v
- CVSS
- Horizon3.ai
- KEVIntel
- SonicWall
Techniques named here
- Decoy SMA systems used to detect exploitation attempts
- SSRF
Related in Threat Intel
huntress.comwriteupReverse Engineering the Six Stages of MacSync Stealer and RAT
huntress.comwriteupAI-Coded Malware | Analyzing Vibe-Coded AD Enumeration | Huntress
blog.talosintelligence.comtoolIntroducing CAIRN: Frontier tracking for AI-integrated malware (Cisco Talos)
huntress.comwriteup