🔴 Critical SonicWall Vulnerability Exploited Days After Disclosure

Threat actors started exploiting a recently patched critical vulnerability in SonicWall SMA1000 appliances within days after public disclosure.

Tracked as CVE-2026-102255 (CVSS score of 10), the security defect is described as a pre-authenticated server-side request forgery (SSRF) issue affecting the SMA1000 Work Place interface.

According to SonicWall, an unintended alternate access path could allow a remote attacker “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”