[{"data":1,"prerenderedAt":-1},["ShallowReactive",2],{"$fai70CsA_Z3K1nl2ak66i_Zbb5dS3OMUvWESEfjeZU4g":3},{"article":4,"iocs":41,"watch_terms":46,"solutions":47,"lesson":141},{"id":5,"title":6,"slug":7,"summary":8,"ai_summary":9,"brief":10,"url":11,"image_url":12,"published_at":13,"ingested_at":14,"relevance_score":15,"entities":16,"category_id":23,"category":24,"article_tags":28},"36f14134-0f0b-44e2-8605-837df24d32ae","Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch","critical-sonicwall-sma-1000-flaw-targeted-in-135-exploitation-attempts-after-pat-c7baac","Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure. The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker \"to direct the appliance to issue requests on their","A critical pre-authenticated SSRF vulnerability (CVE-2026-102255) in SonicWall SMA 1000 appliances is being actively exploited. Threat actors have already made 135 exploitation attempts shortly after the flaw was publicly disclosed and patched. The vulnerability allows remote attackers to force the appliance to issue requests on their behalf.","Critical SonicWall SMA 1000 flaw exploited in 135 attempts post-patch.","https:\u002F\u002Fthehackernews.com\u002F2026\u002F10\u002Fcritical-sonicwall-sma-1000-flaw.html","https:\u002F\u002Fblogger.googleusercontent.com\u002Fimg\u002Fb\u002FR29vZ2xl\u002FAVvXsEglEbu7YOWX4lrTm_x8p2FnL6B7z2hhGC0fKWPBSCVJqTt8l0rbcXFhQinT3ja0sVyx7hObbCQlmem9y4-wsxrwU6mtgsBIJjvH7rgC8n5w8DpEcv7G1N_u4dtOzA3qxVk22FPvly-ZmjsLJKdJqgTsKPtMHpit1oq-fk7jPFN1gTHLeJdF2JQRZ8yuwjxv\u002Fs1600\u002Fsonics.jpg","2026-10-12T10:36:56+00:00","2026-10-12T12:00:15.698227+00:00",9,[17,20],{"name":18,"type":19},"SMA 1000","product",{"name":21,"type":22},"SonicWall","vendor","80544778-fabb-4dcd-aa35-17492e5dcf4f",{"id":23,"icon":25,"name":26,"slug":27},null,"Vulnerabilities","vulnerabilities",[29,34,36],{"category":30},{"id":31,"icon":25,"name":32,"slug":33},"6cbdd207-aaa1-4176-9534-e156b125e917","Nation-state","nation-state",{"category":35},{"id":23,"icon":25,"name":26,"slug":27},{"category":37},{"id":38,"icon":25,"name":39,"slug":40},"e7b231c8-5f79-4465-8d38-1ef13aea5a14","Threat Intelligence","threat-intelligence",[42],{"type":43,"value":44,"context":45},"cve","CVE-2026-102255","Critical pre-authenticated SSRF vulnerability in SonicWall SMA 1000",[21,18],{"controls":48,"vendors":135},[49,78,107],{"slug":50,"name":51,"problem":52,"products":53},"vulnerability-management","Vulnerability scanning and prioritisation","You know which systems are vulnerable, and which ones to fix first.",[54,62,70],{"vendor_slug":55,"vendor_name":56,"vendor_logo":57,"product_slug":58,"product_name":59,"url":60,"description":61},"tenable","Tenable","\u002Fvendor-logos\u002Ftenable.png","tenable-vulnerability-management","Tenable Vulnerability Management","https:\u002F\u002Fwww.tenable.com\u002Fproducts\u002Fvulnerability-management","Cloud-based vulnerability scanning and prioritisation, built on Nessus.",{"vendor_slug":63,"vendor_name":64,"vendor_logo":65,"product_slug":66,"product_name":67,"url":68,"description":69},"qualys","Qualys","\u002Fvendor-logos\u002Fqualys.png","vmdr","Qualys VMDR","https:\u002F\u002Fwww.qualys.com\u002Fapps\u002Fvulnerability-management-detection-response\u002F","Vulnerability management, detection and response with risk-based prioritisation.",{"vendor_slug":71,"vendor_name":72,"vendor_logo":73,"product_slug":74,"product_name":75,"url":76,"description":77},"axonius","Axonius","\u002Fvendor-logos\u002Faxonius.png","axonius-exposures","Axonius Exposures","https:\u002F\u002Fwww.axonius.com\u002Fplatform\u002Fexposures","Brings findings from different scanners together with asset and business context, to show what matters most and track fixes to the end.",{"slug":79,"name":80,"problem":81,"products":82},"patch-management","Automated patch management","Known holes get closed in days, not months.",[83,91,99],{"vendor_slug":84,"vendor_name":85,"vendor_logo":86,"product_slug":87,"product_name":88,"url":89,"description":90},"manageengine","ManageEngine","\u002Fvendor-logos\u002Fmanageengine.png","patch-manager-plus","ManageEngine Patch Manager Plus","https:\u002F\u002Fwww.manageengine.com\u002Fpatch-management\u002F","Patch management for operating systems and third-party applications, on premises or in the cloud.",{"vendor_slug":92,"vendor_name":93,"vendor_logo":94,"product_slug":95,"product_name":96,"url":97,"description":98},"ivanti","Ivanti","\u002Fvendor-logos\u002Fivanti.png","neurons-patch-management","Ivanti Neurons for Patch Management","https:\u002F\u002Fwww.ivanti.com\u002Fproducts\u002Fivanti-neurons-for-patch-management","Risk-based patch management for operating systems and third-party applications.",{"vendor_slug":100,"vendor_name":101,"vendor_logo":102,"product_slug":103,"product_name":104,"url":105,"description":106},"microsoft","Microsoft","\u002Fvendor-logos\u002Fmicrosoft.png","intune","Microsoft Intune","https:\u002F\u002Fwww.microsoft.com\u002Fen-us\u002Fsecurity\u002Fbusiness\u002Fmicrosoft-intune","Device management for Windows, macOS, iOS and Android, including update rings and compliance policies.",{"slug":40,"name":108,"problem":109,"products":110},"Threat intelligence","Attack campaigns reach your sector, suppliers or software before your team hears about them.",[111,119,127],{"vendor_slug":112,"vendor_name":113,"vendor_logo":114,"product_slug":115,"product_name":116,"url":117,"description":118},"dataminr","Dataminr","\u002Fvendor-logos\u002Fdataminr.png","agentic-threat-intelligence-platform","Agentic Threat Intelligence Platform","https:\u002F\u002Fwww.dataminr.com\u002Fproducts\u002Fcyber-defense\u002Fagentic-threat-intelligence-platform\u002F","Threat intelligence platform, formerly ThreatConnect TI Ops, that collects, scores and structures intelligence and pushes it into security tools.",{"vendor_slug":120,"vendor_name":121,"vendor_logo":122,"product_slug":123,"product_name":124,"url":125,"description":126},"crowdstrike","CrowdStrike","\u002Fvendor-logos\u002Fcrowdstrike.png","falcon-adversary-intelligence","Falcon Adversary Intelligence","https:\u002F\u002Fwww.crowdstrike.com\u002Fen-us\u002Fplatform\u002Fthreat-intelligence\u002F","Threat intelligence on the adversaries CrowdStrike tracks, built into the Falcon platform to detect, disrupt and defend against them.",{"vendor_slug":128,"vendor_name":129,"vendor_logo":130,"product_slug":131,"product_name":132,"url":133,"description":134},"google","Google","\u002Fvendor-logos\u002Fgoogle.png","google-threat-intelligence","Google Threat Intelligence","https:\u002F\u002Fcloud.google.com\u002Fsecurity\u002Fproducts\u002Fthreat-intelligence","Threat intelligence from Mandiant's frontline investigations, Google's threat analysts, open sources and Google's own visibility, in one service.",[136],{"slug":137,"name":21,"logo_path":138,"roles":139},"sonicwall","\u002Fvendor-logos\u002Fsonicwall.png",[140],"affected",{"slug":142,"title":143,"body":144,"framework_refs":145,"framework_notes":156},"sonicwall-sma-1000-ssrf-flaw-exploited-within-hours-of-patch-release","SonicWall SMA 1000 SSRF Flaw Exploited Within Hours of Patch Release","A critical pre-authenticated Server-Side Request Forgery (SSRF) vulnerability in SonicWall SMA 1000 appliances was actively exploited 135 times shortly after public disclosure and patching, highlighting the razor-thin window organizations have to act. Because the flaw requires no authentication, threat actors can remotely abuse the appliance to proxy malicious requests through it, effectively weaponizing a trusted network device. This incident underscores the dangerous reality that attackers now monitor patch releases and reverse-engineer vulnerabilities faster than most organizations can deploy fixes. Internet-facing security appliances are high-value targets precisely because they sit at the perimeter with privileged network access, making rapid patching and network isolation critical defensive measures.",[146,147,148,149,150,151,152,153,154,155],"CIS Control 7: Continuous Vulnerability Management","CIS Control 12: Network Infrastructure Management","CIS Control 13: Network Monitoring and Defense","NIST SP 800-40 Rev 4: Guide to Enterprise Patch Management","NIST SI-2: Flaw Remediation","NIST SC-7: Boundary Protection","NIST RA-5: Vulnerability Monitoring and Scanning","NIST IR-4: Incident Handling","ITIL: Change Management \u002F Emergency Change Procedure","CISA KEV (Known Exploited Vulnerabilities) Catalog Guidance",{}]