{"id":3485,"date":"2026-10-12T11:58:49","date_gmt":"2026-10-12T11:58:49","guid":{"rendered":"https:\/\/thedigitalfortress.us\/?p=3485"},"modified":"2026-10-12T11:58:49","modified_gmt":"2026-10-12T11:58:49","slug":"critical-sonicwall-sma-1000-flaw-targeted-in-135-exploitation-attempts-after-patch","status":"publish","type":"post","link":"https:\/\/thedigitalfortress.us\/?p=3485","title":{"rendered":"Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch"},"content":{"rendered":"
\n

\ue804<\/i>Ravie Lakshmanan<\/span>\ue802<\/i>Oct 12, 2026<\/span><\/span>Vulnerability \/ Network Security<\/span><\/p>\n<\/div>\n

\n
<\/a><\/div>\n

Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of public disclosure.<\/p>\n

The vulnerability, tracked as CVE-2026-102255 (CVSS score: 10.0), is a case of pre-authenticated server-side request forgery (SSRF) that could allow a remote attacker \u00abto direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.\u00bb<\/p>\n

Patches for the flaw were released by SonicWall on October 6, 2026, with versions 12.4.3-03670 (platform-hotfix) and 12.5.0-03082 (platform-hotfix).<\/p>\n

The vulnerability has since started witnessing active exploitation attempts, with first signs detected by threat intelligence firms Defused Cyber<\/a> and Previdian<\/a> on October 8, 2026.<\/p>\n

Data from Previdian shows that a total of 135 attempts<\/a> have been observed to date from two unique IP addresses located in the U.S. SonicWall has yet to update the advisory<\/a> to reflect active exploitation of the flaw.<\/p>\n

\n
\"Cybersecurity\"<\/a><\/div>\n<\/div>\n

CVE-2026-102255 is the latest vulnerability impacting SonicWall SMA 1000 appliances to come under active exploitation. In June 2026, two other flaws in the same product (CVE-2026-15409, CVSS score: 10.0, and CVE-2026-15410, CVSS score: 7.2) were weaponized as zero-days by a threat actor dubbed UTA0533 to deploy Java web shells and a malware called KNUCKLEBALL.<\/p>\n

Rapid7 also said it observed threat actors leveraging the flaws to target internet-facing devices and use them as a stealthy initial access vector to execute commands on the operating system and ensure long-term, persistent access.<\/p>\n

\u00abOnce they established a foothold on the appliance, the actors systematically extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication (MFA) seed configurations,\u00bb the company noted<\/a>.<\/p>\n

\u00abWith these harvested resources, the threat actors quickly shifted to lateral movement, pivoting from the compromised appliance directly into the internal corporate network.\u00bb<\/p>\n<\/div>\n","protected":false},"excerpt":{"rendered":"

\ue804Ravie Lakshmanan\ue802Oct 12, 2026Vulnerability \/ Network Security Threat actors have been observed exploiting a recently disclosed critical security flaw in SonicWall Secure Mobile Access (SMA) 1000 appliances within days of…<\/p>\n","protected":false},"author":1,"featured_media":3486,"comment_status":"open","ping_status":"closed","sticky":false,"template":"","format":"standard","meta":{"footnotes":""},"categories":[1],"tags":[1202,58,65,70,348,820,2538,113],"class_list":["post-3485","post","type-post","status-publish","format-standard","has-post-thumbnail","hentry","category-uncategorized","tag-attempts","tag-critical","tag-exploitation","tag-flaw","tag-patch","tag-sma","tag-sonicwall","tag-targeted"],"_links":{"self":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3485","targetHints":{"allow":["GET"]}}],"collection":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts"}],"about":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/types\/post"}],"author":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/users\/1"}],"replies":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcomments&post=3485"}],"version-history":[{"count":0,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/posts\/3485\/revisions"}],"wp:featuredmedia":[{"embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=\/wp\/v2\/media\/3486"}],"wp:attachment":[{"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fmedia&parent=3485"}],"wp:term":[{"taxonomy":"category","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Fcategories&post=3485"},{"taxonomy":"post_tag","embeddable":true,"href":"https:\/\/thedigitalfortress.us\/index.php?rest_route=%2Fwp%2Fv2%2Ftags&post=3485"}],"curies":[{"name":"wp","href":"https:\/\/api.w.org\/{rel}","templated":true}]}}