SonicWall SMA1000 Max-Severity Flaw Exploited

Attackers began exploiting CVE-2026-102255 in SonicWall SMA1000 appliances within three days of the patch shipping. SonicWall issued the fix on October 7, 2026. BleepingComputer confirmed active exploitation in the wild by October 9. CVSS score: 10.0, the ceiling.

Seventy-two hours from patch to observed attacks is short, but it tracks with how perimeter appliances at this severity tier get treated: SMA1000 is externally reachable by design, broadly deployed in enterprise environments, and a working exploit hands an attacker a foothold before most internal defenses see any traffic.

What administrators should do

Patch to the fixed firmware version immediately. Consult the NVD record for CVE-2026-102255 and the SonicWall PSIRT portal for affected versions and upgrade instructions. If immediate patching is not possible, restrict management-interface exposure and increase monitoring for anomalous remote-access activity.

Pattern, not anomaly

This is the third time in 2026 that SonicWall SMA1000 vulnerabilities have moved from disclosure to active exploitation quickly. In September, two zero-days in the same product were under active exploitation with no patch available at the time of disclosure. CISA documented ransomware operators targeting unpatched SMA1000 units in August. Before that, Volexity linked SMA1000 flaws to a sustained intrusion campaign by threat group UTA0533 in the July 2026 reporting.

Threat actor attribution for CVE-2026-102255 exploitation has not been confirmed. Organizations with SMA1000 on the perimeter should treat this as an active threat and patch without waiting for further details.

Source: BleepingComputer, NVD CVE-2026-102255.