Habla con un experto
PreciosNoticiasHabla con un experto
Volver a la sala de prensa
Amenazas

Critical SonicWall SMA 1000 Flaw Hit by Exploitation Attempts Days After Patch

Attackers began probing SonicWall SMA 1000 appliances for CVE-2026-102255, a CVSS 10.0 pre-auth SSRF, just two days after the fix shipped. Here's what it means and what to do.

4T4Tify Team4Tify
Oct 12, 2026·4 min de lectura
Critical SonicWall SMA 1000 Flaw Hit by Exploitation Attempts Days After Patch

Critical SonicWall SMA 1000 SSRF Flaw Draws Exploitation Attempts Days After Patch

Attackers are already probing SonicWall Secure Mobile Access (SMA) 1000 appliances for CVE-2026-102255, a maximum-severity (CVSS 10.0) flaw patched only on October 6, 2026. If you run an SMA 1000 that is reachable from the internet and not yet updated, treat it as a priority today.

What happened

  • The flaw: CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) bug. An unauthenticated remote attacker can make the appliance send requests on their behalf, reaching internal functionality and performing actions they should never be allowed to.
  • The fix: SonicWall shipped patched builds on October 6, 2026 — 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix).
  • The probing: Threat intelligence firms reported the first exploitation attempts on October 8, just two days later. One dataset counts 135 attempts so far, originating from two IP addresses located in the U.S. At the time of reporting, SonicWall's advisory had not yet been updated to reflect active exploitation.

These are exploitation attempts — public reporting does not yet confirm how many, if any, appliances were successfully compromised through this specific bug.

Why it matters

This is not the first time SMA 1000 has been a target this year. In June 2026, two other flaws in the same product — CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) — were exploited as zero-days by a cluster tracked as UTA0533, which deployed Java web shells and a malware family called KNUCKLEBALL.

Incident responders who investigated those intrusions described a familiar playbook: compromise the internet-facing appliance, use it as a quiet foothold to run commands on the operating system, and maintain long-term access. From there, the operators harvested credentials, active session databases and TOTP MFA seed configurations, then pivoted into the internal corporate network.

That last point is the real risk. A remote-access gateway sits at the edge of your network and holds the keys to it. Stolen MFA seeds mean an attacker can keep generating valid one-time codes even after passwords are reset. A new pre-auth bug in the same appliance — now under active probing — puts organizations on the same path again.

What to do

  1. Patch now. Upgrade SMA 1000 appliances to 12.4.3-03670 or 12.5.0-03082 (platform-hotfix) or later. Don't wait for the advisory to be marked "exploited".
  2. Reduce exposure. If you can't patch immediately, restrict access to the management interface and, where possible, the appliance itself to trusted IP ranges.
  3. Hunt, don't just patch. Review appliance and proxy logs from October 6 onward for unusual outbound requests originating from the appliance and for unexpected internal connections. Look for unknown files or web shells on the device.
  4. If you were exposed during the June zero-days, assume credentials may be at risk: rotate accounts used through the appliance, invalidate active sessions and re-enroll TOTP MFA so any stolen seeds become useless.
  5. Watch lateral movement. Alert on new connections from the SMA appliance to internal servers, domain controllers and admin interfaces that it doesn't normally talk to.
  6. Inventory your edge. Confirm you know every remote-access appliance you own, its version and who owns patching it — edge devices remain one of the most reliable entry points for attackers.

Based on reporting by The Hacker News.

4Tify Team

COMPARTIR