What Happened
SonicWall patched CVE-2026-102255 on October 6. The flaw is a pre-authentication server-side request forgery in the SMA 1000 remote access appliance, and it scores 10.0 in CVSS. The Hacker News reports Defused Cyber and Previdian saw first exploitation on October 8. Previdian logged 135 attempts from two U.S. IP addresses.
Fixed builds are 12.4.3-03670 and 12.5.0-03082. As of the report, SonicWall had not updated advisory SNWLID-2026-0017 to note active exploitation. BleepingComputer also reports attacks began three days after the patch.
Why This Matters for Canadian Organizations
The SMA 1000 sits at the network edge and brokers remote access, which makes it a prized target. This is not the first incident. In June, attackers exploited CVE-2026-15409 and CVE-2026-15410 as zero-days to deploy Java web shells and KNUCKLEBALL malware. Rapid7 reported attackers used compromised appliances to harvest credentials, session data, and TOTP MFA seeds.
A pre-authentication SSRF lets an attacker reach internal functions without a login. Canadian enterprises, hospitals, and municipalities use these appliances for remote staff. A compromise exposes internal systems and personal information, which brings PIPEDA breach reporting duties. The gap between patch and attack now runs to days, and attackers do not wait for your change window.
What to Do
Identify every SMA 1000 in your environment, including units run by managed providers. Install 12.4.3-03670 or 12.5.0-03082 now. Restrict management interfaces to trusted networks. Review logs since October 6 for unexpected outbound requests, new web shells, and new admin accounts. If you find signs of compromise, rotate credentials and re-enrol MFA seeds. For related coverage, see our TechTalk archive and News archive.
