Project
SonicWall SMA1000 is a secure remote access appliance series providing SSL VPN and WorkPlace portal access for enterprise users to internal applications.
Defused researchers say first exploitation attempts reached their decoys on 8 October, two days after SonicWall disclosed its CVSS 10.0 SMA1000 flaw. The advisory, last updated 6 October, still says there is no evidence of exploitation.
Reality
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
Perspective Coverage
7 publishersReality
SonicWall patched four SMA1000 flaws, led by CVE-2026-102255, a CVSS 10 request-forgery bug that an attacker can use without logging in. The company says none of the four is being exploited, so owners who update now are ahead of any known attack.
Reality
SonicWall confirmed both SMA1000 flaws were exploited before disclosure, and CISA gave federal agencies three days to remediate. The lower-scored console bug is the step that reaches the operating system.
Reality
Three published exposure counts for the September 2026 SonicWall SMA1000 chain measure three different objects: identifiable banners, text mentions, and observed instances.
Reality
Sixteen new modules landed in the framework, ten of them exploits, and Rapid7 counts five of those against CISA's exploited list. The SonicWall entry runs September's zero-day chain from SSRF to root.
Reality
Hunt.io crawled the operator's own open directory and found the campaign output: 250 SonicWall SMA1000 appliances scanned, 168 leaking LDAP credentials, five Active Directory databases replicated in full.
Reality
Rapid7's latest wrap-up ships working exploit code for seven separately documented flaws, including an unauthenticated Joomla web shell and a Linux kernel LPE. Reprioritize this week, not next cycle.
Reality