Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
Critical SonicWall SMA 1000 flaw exploited in 135 attempts post-patch.
Run SonicWall?
Get an email when a reviewed story names SonicWall, usually within the hour.
Free. Your list stays private and never appears in a subject line. One click stops it. How Vendor Watch worksPrivacy
Summary
A critical pre-authenticated SSRF vulnerability (CVE-2026-102255) in SonicWall SMA 1000 appliances is being actively exploited. Threat actors have already made 135 exploitation attempts shortly after the flaw was publicly disclosed and patched. The vulnerability allows remote attackers to force the appliance to issue requests on their behalf.
The lesson from this incident
Full lessonA critical pre-authenticated Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA 1000 appliances was actively exploited 135 times shortly after public disclosure and patching, highlighting the razor-thin window organizations have to act. Because the flaw requires no authentication, threat actors can remotely abuse the appliance to proxy malicious requests through it, effectively weaponizing a trusted network device. This incident underscores the dangerous reality that attackers now monitor patch releases and reverse-engineer vulnerabilities faster than most organizations can deploy fixes. Internet-facing security appliances are high-value targets precisely because they sit at the perimeter with privileged network access, making rapid patching and network isolation critical defensive measures.
What helps against this
How we list vendors
- Vulnerability scanning and prioritisation
You know which systems are vulnerable, and which ones to fix first.
- Automated patch management
Known holes get closed in days, not months.
- Threat intelligence
Attack campaigns reach your sector, suppliers or software before your team hears about them.
Indicators of Compromise
- cve — CVE-2026-102255