SonicWall's 10/10 Flaw Was Exploited 2 Days After Disclosure

SonicWall disclosed a critical flaw in its SMA1000 remote-access appliances on 6 October. By 8 October — two days later — attackers were already trying to exploit it. That gap is the real story here.

On 6 October 2026, SonicWall disclosed CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) flaw in the SMA1000 Work Place interface, rated a maximum CVSS 10.0. In plain terms: an attacker who can reach the appliance over the internet can trick it into making requests on their behalf and reach the internal systems it was meant to protect. Security firm Horizon3.ai warned it can lead to full device takeover. The affected models are the 6210, 7210 and 8200v.

Here's what should make every business owner sit up. Honeypots run by researchers at Defused recorded the first exploitation attempts on 8 October — just two days after the patch went public. This is the pattern now, not the exception. The old habit of rolling internet-facing security gear into a monthly or quarterly patch cycle quietly assumes you have weeks to act. You don't. And it wasn't an isolated week: the very next day, CISA added a freshly exploited Ivanti Connect Secure flaw to its Known Exploited Vulnerabilities catalog. The boxes that sit at the edge of your network to keep attackers out are now among the fastest-weaponised targets going.

Most Australian SMBs don't run an SMA1000, though. They run a TZ-series firewall or an SMA100 — often installed years ago by a previous provider and quietly humming along ever since. So the useful question isn't really "are we affected by this exact CVE." It's "does anyone actually track SonicWall's advisories and apply firmware updates for us — within days, not months?" In the environments we take over, that answer is often nobody in particular. The appliance works, so it falls off everyone's radar until a flaw like this one turns it into the way in.

What to Do This Week

• Running an SMA1000? Update to 12.5.0-03082 or 12.4.3-03670 immediately, ahead of any normal change window.
• Don't know your firewall model or firmware version? Find out this week — you can't patch what nobody's tracking.
• Lock down management access. Confirm firewall and VPN admin interfaces aren't reachable from the public internet.
• Name an owner. Be clear on who applies firmware updates for your edge gear — your team, your current provider, or no one.

Written by Caleb Attard, All IT Services. All IT is a Sydney-based managed IT provider supporting businesses across Australia, including the Northern Beaches, Central West NSW, Brisbane and Melbourne.