Attackers are actively targeting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances, according to multiple outlets. The issue is identified as CVE-2026-102255 (CVSS 10.0) and involves a pre-authenticated server-side request forgery (SSRF) condition, meaning exploitation does not require valid login credentials.
Reporting indicates exploitation begins soon after the flaw is publicly disclosed. The Hacker News says threat actors were observed attempting exploitation within days and cites 135 exploitation attempts, while Dark Reading frames the activity as ongoing attacks on affected devices. SecurityWeek similarly reports that the vulnerability is being exploited days after disclosure.
Across coverage, the core concern is that SSRF could let a remote attacker induce the appliance to make unauthorized outbound requests or otherwise perform actions indirectly through the device. While outlets differ in the emphasis on timing and observed attempt counts, they broadly agree on the severity of the vulnerability, its pre-authenticated SSRF nature, and the fact that it is under active attack.
