Swiss SME Cyber Alert: SonicWall SMA1000 – active exploitation attempts target a critical remote-access flaw
Updated: Oct 13
Active exploitation attempts are now targeting the critical CVE-2026-102255 vulnerability in SonicWall SMA1000. The internet-facing Work Place interface can be abused without signing in. If your organisation uses this remote-access platform, ask your IT provider to verify the hotfix build and check for possible traces since 9 October immediately.
What happened?
SonicWall disclosed CVE-2026-102255 through CVE-2026-102258 on 6 October 2026. On 9 and 10 October, Previdian recorded 135 exploitation attempts targeting CVE-2026-102255 from two IP addresses. This telemetry confirms deliberate attempts to exploit the flaw; on its own, it does not prove that any organisation was successfully compromised.
Could my organisation be affected?
Affected systems are SonicWall SMA1000 appliances running platform hotfixes earlier than 12.4.3-03670 or 12.5.0-03082. These appliances provide secure remote access and VPN connectivity. If staff or external partners connect to your company network through an SMA1000 appliance, an immediate version check is required.
What should you do now?
Ask your IT provider to verify the complete platform-hotfix build and update to 12.4.3-03670 or later, or 12.5.0-03082 or later. They should also validate whether the appliance is internet-facing and review logs since 9 October for matching or unusual requests. SonicWall lists no complete workaround.
How urgent is it?
Very urgent. CVE-2026-102255 can be reached through the Work Place interface without signing in and carries a CVSS score of 10.0. Primary sensor data confirms active exploitation attempts. The update and evidence review should therefore not wait for the next routine maintenance window.
Information for your IT provider
Advisory: SNWLID-2026-0017. Actively targeted flaw: CVE-2026-102255, pre-authentication SSRF in the Work Place interface. Fixed builds: 12.4.3-03670 and 12.5.0-03082. Previdian reports 135 attempts from two unique IP addresses, first observed on 9 October 2026 and last observed on 10 October 2026. The other CVEs in the advisory are CVE-2026-102256, CVE-2026-102257 and CVE-2026-102258.
