SonicWall SMA 1000 CVE-2026-102255 SSRF Exploited 135 Times from Two US IPs Within 48 Hours of Patch

The flaw permits unauthenticated remote attackers to coerce the appliance into issuing internal requests, reaching management functions and enabling unauthorized operations. Defused Cyber and Previdian telemetry recorded the first probes on October 8; both sources tie the activity to the same two source IPs and note no successful payload delivery observed yet.

This marks the third high-severity SonicWall SMA 1000 issue under active exploitation in four months. June 2026 zero-days CVE-2026-15409 and CVE-2026-15410 were used by UTA0533 to drop Java web shells and KNUCKLEBALL malware, then harvest TOTP seeds and session databases for lateral movement. Rapid7 documented the same pattern of initial access followed by credential extraction.

SonicWall has not updated its advisory to acknowledge in-the-wild exploitation despite the 135 attempts. The continued U.S.-origin traffic and absence of broader attribution data suggest either compromised infrastructure or testing activity rather than state-linked operations.

Administrators should verify hotfix deployment immediately and monitor for anomalous outbound requests from SMA appliances; unpatched devices remain reachable for at least another 30 days based on prior campaign dwell times.