SecurityWeek reported on October 12 that SonicWall disclosed a critical flaw in its SMA1000 appliances on October 6. It is tracked as CVE-2026-102255 and scores 10 on the CVSS severity scale. Defused, a threat intelligence firm, said the first attempts to reach its decoy systems came on October 8, two days after disclosure. Previdian, formerly KEVIntel, said its sensors also see attempts. SonicWall told owners of the 6210, 7210 and 8200v models to update.
The flaw is a server-side request forgery in the Work Place interface. SonicWall says an unintended alternate access path lets a remote attacker make the appliance send requests for them and reach internal functions. Pre-authenticated means no login is needed first. Horizon3.ai warned that success could let attackers take over a device. The sources do not say who is behind the attempts or whether real customer devices were hit. Defused's is the first sighting reported, not necessarily the first attempt.
In this case, attempts reached Defused's decoys two days after disclosure, and SecurityWeek names no victims. Three checks follow. List every SMA1000 unit and its model. Set a patch-time target in days. Confirm who can reach the Work Place interface.