A maximum-severity flaw in SonicWall’s SMA1000 remote-access appliances is now being targeted in the wild, according to updated government and researcher reporting.

SonicWall disclosed CVE-2026-102255 on October 6. The pre-authentication server-side request forgery flaw carries a CVSS score of 10.0 and affects SMA1000 models 6210, 7210 and 8200v on older 12.4.3 and 12.5.0 hotfix levels.

Previdian reported exploitation attempts consistent with CVE-2026-102255.

SonicWall’s original notice said it had no evidence of exploitation. That picture changed after Previdian’s honeypots detected matching activity. The Canadian Centre for Cyber Security updated its advisory on October 9 to say open-source reporting indicates the flaw is being exploited. Researchers have not established that every observed attempt successfully compromised a device.

SonicWall recommends upgrading affected appliances to its fixed hotfix releases. The incident reinforces the same patching pressure seen in BitcoinVersus.Tech coverage of the WatchGuard Firebox VPN flaw, Cisco’s exploited SD-WAN zero-day, and our explainer on why security updates matter.

SonicWall explains the SMA 100 and SMA1000 secure remote-access product families.