SonicWall SMA 1000 hit by a third wave of exploited flaws in four months

SonicWall's Secure Mobile Access (SMA) 1000 remote-access appliances are under attack again. The Hacker News reported on October 12, 2026 that CVE-2026-102255, a pre-authentication server-side request forgery flaw rated CVSS 10.0, was being exploited within days of SonicWall's October 6 hotfixes (builds 12.4.3-03670 and 12.5.0-03082). Researchers at Defused Cyber and Previdian first saw attempts on October 8. This follows two earlier rounds: CVE-2026-15409 and CVE-2026-15410, disclosed July 14 and exploited as zero-days, and CVE-2026-83548 and CVE-2026-83549, disclosed September 1 and also confirmed exploited, according to Tenable and Sophos.

The SMA 1000 is the front door for remote employees and contractors at many mid-sized and larger organizations. According to Rapid7 research cited by The Hacker News, attackers in the earlier campaign used compromised appliances to harvest credentials, session databases and TOTP multi-factor seed configurations before moving into internal networks. That means a breached appliance can undermine MFA itself, not just the VPN.

If you run SMA 1000 models 6210, 7210 or 8200v, confirm you are on the October hotfix build, not just the July or September fixes. Because each prior wave had exploitation before or shortly after patching, review appliance logs for suspicious requests, check SonicWall's published indicators of compromise, and consider resetting user credentials and re-enrolling MFA tokens if there is any sign of compromise. Ask your provider or MSP to show you the patch date and version on each appliance.

Three exploited rounds in roughly four months is also a reasonable prompt to review whether your remote-access design concentrates too much risk on a single internet-facing box, and how quickly your team can patch when the next advisory arrives.