SonicWall SMA 1000 SSRF Flaw Exploited in Wild Within Days of Disclosure

SonicWall Secure Mobile Access (SMA) 1000 appliances are under active attack following the disclosure of a critical server-side request forgery (SSRF) vulnerability. According to reporting from The Hacker News, threat actors began exploiting the flaw within days of public disclosure, and over 135 exploitation attempts have been observed in the wild following the release of patches.

The vulnerability, tracked as CVE-2026-102255, carries a CVSS score of 10.0 and is described as a pre-authenticated SSRF issue. This means that, without requiring prior authentication, a remote attacker can craft requests that direct the SMA 1000 appliance to forward traffic to arbitrary destinations. Such a vector could enable unauthorized access, data exfiltration, or lateral movement into protected networks.

SonicWall has released security updates to address the flaw. The company and external researchers urge administrators to apply the patches immediately. Security teams are advised to monitor logs for unusual outbound connections originating from SMA appliances and to verify the applicability of the update for their specific device firmware versions.

The rapid emergence of exploitation activity shortly after disclosure underscores the urgency of prompt patch management for edge-network devices. CISA and SonicWall have been referenced in connection with the advisory, and administrators are encouraged to consult the official vendor advisory and the CISA Known Exploited Vulnerabilities (KEV) catalog for confirmation and guidance.