Critical SonicWall SMA 1000 Flaw Probed Within Two Days of Patch Release
A critical pre-authentication SSRF vulnerability in SonicWall’s SMA 1000 remote access appliances, tracked as CVE-2026-102255 with a CVSS score of 10.0, drew at least 135 exploitation attempts from two U.S. IP addresses just two days after patches were issued.
Attackers began targeting a severe flaw in SonicWall’s SMA 1000 line almost immediately after a fix was published, underscoring how little time organizations have to patch exposed systems.
The bug, identified as CVE-2026-102255, is a pre-authentication server-side request forgery (SSRF) vulnerability in SonicWall’s Secure Mobile Access 1000 series. It carries the maximum CVSS severity score of 10.0. Because it is pre-authentication, an attacker can attempt to exploit it without valid user credentials.
SonicWall released patches for affected devices, but by two days after those updates became available, monitoring had already recorded 135 exploitation attempts tied to just two IP addresses located in the United States, according to public reporting.
These early attempts don’t confirm that intrusions succeeded, but they show that threat actors quickly incorporated the new information into their scanning and attack routines. Remote access gateways like the SMA 1000 often sit at the edge of networks and handle sensitive connections to internal systems, which makes any serious vulnerability in them particularly dangerous.
Security teams running SMA 1000 devices now face a tight timeline. They need to identify all deployments, apply SonicWall’s patches, and review logs from the days immediately after the advisory for signs of suspicious requests, especially those linked to the IP addresses already observed.
The episode reinforces how quickly high-impact vulnerabilities on widely deployed edge devices become live targets once technical details are public. Key things to watch are whether exploitation spreads beyond the initial IP addresses, whether any major breaches are tied back to CVE-2026-102255, and whether SonicWall or government agencies issue additional guidance on locking down these appliances.
Sources
- OSINT