Cybersecurity
SonicWall flaw sees 135 exploitation attempts
SonicWall patched a critical SMA 1000 flaw on 6 October, and researchers later said they saw exploitation attempts from two U.S. IP addresses, with 135 attempts counted by Previdian.
- SonicWall released patches for CVE-2026-102255 on 6 October 2026 in versions 12.4.3-03670 and 12.5.0-03082.
- Defused Cyber and Previdian said they first detected exploitation attempts on 8 October 2026.
- Previdian said it had seen 135 attempts from two unique IP addresses in the U.S.
- SonicWall had not yet updated its advisory to mention active exploitation.
- Rapid7 said two other SMA 1000 flaws, CVE-2026-15409 and CVE-2026-15410, were used in June 2026 as zero-days by UTA0533.
SonicWall released fixes for CVE-2026-102255 on 6 October 2026, with platform-hotfix versions 12.4.3-03670 and 12.5.0-03082. The article said the flaw was a pre-authenticated server-side request forgery that could let a remote attacker make the appliance issue requests and reach internal functions.
Defused Cyber and Previdian said they first saw exploitation attempts on 8 October 2026. Previdian said it had recorded 135 attempts so far, coming from two unique IP addresses in the U.S.
SonicWall had not yet updated its advisory to say the flaw was being actively exploited. The article described CVE-2026-102255 as the latest SMA 1000 issue to be used in attacks.
It also said two earlier SMA 1000 vulnerabilities, CVE-2026-15409 and CVE-2026-15410, were used in June 2026 as zero-days by a group called UTA0533. According to the article, those attacks deployed Java web shells and KNUCKLEBALL.
Rapid7 said attackers also targeted internet-facing devices to gain initial access and maintain access. It said they later took credentials, active session databases and TOTP MFA seed settings before moving into internal networks.
Named in this story
Companies
- SonicWall
- issued patches and had not yet updated its advisory
- Rapid7
- said earlier SMA 1000 flaws were used for access and persistence
Organisations
- Defused Cyber
- said it first saw signs of exploitation on 8 October 2026
- Previdian
- reported 135 attempts from two U.S. IP addresses
- UTA0533
- the threat actor group linked to the June 2026 attacks
Products and systems
- SonicWall Secure Mobile Access (SMA) 1000 appliances
- the affected appliance line targeted by the flaw
- CVE-2026-102255
- the vulnerability under active exploitation attempts
- CVE-2026-15409
- one of the earlier SMA 1000 flaws used as a zero-day
- CVE-2026-15410
- the other earlier SMA 1000 flaw used as a zero-day
- KNUCKLEBALL
- the malware deployed in the earlier attacks
Places
- U.S.
- the location of the two source IP addresses
How the source tells it
The article used a security-alert register, leaning on severe vulnerability labels and rapidly moving exploitation figures.
- alarm severity labelling paired with a maximum CVSS score
- urgency tight timing around patching, first detection and attempt totals