SonicWall customers are on the defensive once again, as threat actors are actively exploiting a maximum-severity vulnerability in the cybersecurity vendor's unified secure access gateway, the Secure Mobile Access (SMA) appliance.
CVE-2026-102255 is a server-side request forgery (SSRF) flaw in the SonicWall SMA 1000 appliance's WorkPlace interface, a Web-based portal for remote users. The vulnerability, which SonicWall assigned a maximum 10 out of 10 CVSS score, stems from an "unintended alternate access path," according to the vendor's advisory.
"By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," SonicWall wrote in the advisory, published Oct. 6.
Just a few days later, two cybersecurity vendors flagged exploitation activity for CVE-2026-102255 on their honeypot devices. On Oct. 9, cybersecurity threat intelligence firm Previdian warned in a post on the social media platform X that it had observed attempts to exploit its sensors. Similarly, cybersecurity vendor Defused noted on X that it saw unauthenticated SSRF traffic on the company's SonicWall SMA decoys starting the day before.