Threat Pulse 62High
SonicWall SMA1000 pre-auth SSRF (CVE-2026-102255, CVSS 10) exploited within two days
Severity 6PatchedconfirmedWeb servers and gateways

SonicWall disclosed a maximum-severity server-side request forgery in the SMA1000 Work Place interface (models 6210, 7210, 8200v) on October 6. Honeypots run by Defused saw exploitation attempts by October 8 and Horizon3 warned it could lead to device takeover. Fixed in 12.5.0-03082 and 12.4.3-03670.

What to do: Fixed in 12.5.0-03082 and 12.4.3-03670; exposed appliances should be assumed probed.

· 30 days ago · SonicWall SMA1000 appliances worldwide · BleepingComputer
SourcesBleepingComputerSecurityWeekHelp Net Security
Why this score

Enterprise remote-access gateways (impact 2), exploitation attempts within days (exploitability 2), gateways fronting sensitive networks (criticality 1), plus maximum CVSS.

Back to the board

Updated Nov 5, 01:46 UTC. Refreshes on its own.

Add a threat

Paste a link to an advisory, an article or an X post. A person reads every submission before it shows; nothing posts on its own.

Share

The picture people see when the link is posted
Post on XSave picture

This picture is what X, iMessage, Slack and Facebook show under the link. It is drawn fresh from the live board: the board and chart pictures update every 10 minutes, an event picture follows that event.