Updated: SonicWall SMA1000 SSRF: Previdian Records 135 Exploitation Attempts, No Breaches Confirmed

Previdian recorded 135 attempts related to the critical CVE-2026-102255 flaw in SonicWall SMA1000 telemetry. Successful compromises of production devices have not yet been publicly confirmed.

Updated: We are adding that Previdian’s telemetry records 135 attempts to exploit CVE-2026-102255 from two sources; successful compromises still have not been confirmed.

SonicWall SMA1000 SSRF, specifically the CVE-2026-102255 vulnerability, is a critical flaw with a CVSS score of 10.0. It appeared in 135 exploitation attempts in Previdian’s telemetry. The data records two sources identified as attackers and the latest observation from October 10 at 03:26 UTC. However, the sensor records themselves do not confirm a successful intrusion into an actual production device.

The flaw affects internet-facing SonicWall SMA 1000 remote-access devices. The vendor has already released fixes for the affected SMA 6210, SMA 7210 and virtual SMA 8200v models.

SonicWall SMA1000 SSRF in Previdian Telemetry

Previdian says the 135 recorded attempts map to CVE-2026-102255. The observations come from its sensor network, not from publicly confirmed incidents at organizations. Therefore, it cannot be inferred that any of the attempts resulted in the compromise of an SMA 1000 device.

The scope of activity beyond Previdian’s sensors, the actors’ identities and the existence of compromised production systems have also not been publicly confirmed. This is a more specific figure than earlier qualitative reports of attempts, but the status of confirmed compromises remains unchanged.

In its advisory from October 5–6, SonicWall said it had no evidence that this group of flaws was being exploited in the wild. The inclusion of CVE-2026-102255 in the CISA Known Exploited Vulnerabilities catalog has also not been confirmed.

Fixes for SonicWall SMA1000 SSRF Are Available

CVE-2026-102255 is a critical unauthenticated SSRF vulnerability. SonicWall released platform hotfixes for the affected platforms in versions 12.4.3-03670 and 12.5.0-03082, or later.

Administrators should verify whether they operate an SMA 6210, SMA 7210 or SMA 8200v and check the platform-hotfix branch in use. The new observation count increases the urgency of updating, although the available data do not demonstrate successful attacks.

  • Verify the device model and installed platform-hotfix version.
  • Deploy hotfix 12.4.3-03670 or 12.5.0-03082, or a later available version for the branch in use.
  • Monitor further SonicWall announcements and any publication of indicators of compromise.

What to Watch Next

SonicWall’s position on whether it has recorded active or successful exploitation since issuing the advisory will be important. The possible addition of CVE-2026-102255 to the CISA KEV catalog and independent confirmation of production-device compromises will also be relevant.

Sources

  • SonicWall Product Notice SNWLID-2026-0017 – Confirms CVE-2026-102255, the affected models, fixed versions and the vendor’s original statement that it had no evidence of exploitation in the wild.
  • Previdian – Observed Exploitation Signals – Reports 135 sensor-detected attempts related to CVE-2026-102255, two sources and the latest observation on October 10 at 03:26 UTC.
  • BleepingComputer – Corroborates Previdian’s earlier report of requests consistent with exploitation and explicitly states that successful compromises were not confirmed.

Verified and updated: October 13, 2026 06:25

Tags
Sharing

Súvisiace