Attackers have started targeting a maximum-severity flaw in SonicWall SMA1000 remote access appliances, only days after SonicWall released a fix. Businesses that have not yet applied the update should treat this as urgent.

• What it is: A server-side request forgery flaw (CVE-2026-102255) in the Appliance WorkPlace interface. A remote attacker with no login can make the appliance send requests on their behalf.
• Who is affected: Organisations using SonicWall SMA1000 6210, 7210 and 8200v appliances. The SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
• The risk: Security researchers have recorded exploitation attempts against internal services on the appliance. Over 400 exposed SMA1000 devices were counted online, and this product line has been a repeat target this year.
• What to do: Apply the SonicWall patch released on 6 October 2026 (advisory SNWLID-2026-0017), review appliance logs for unusual activity, and restrict management access to trusted networks.

We recommend businesses using these appliances patch today. If you are unsure whether you are affected, contact OzComm and we will check for you.

Sources: BleepingComputer