Previdian has detected exploitation attempts consistent with SonicWall SMA1000 vulnerability CVE-2026-102255, according to its public alert and October 9, 2026 reporting by BleepingComputer. The maximum-severity flaw affects secure remote access appliances. Researcher Ryan Dewhurst told BleepingComputer that successful compromise had not been established, distinguishing the observed attempts from confirmed breaches.

SonicWall released hotfixes earlier this week. Its support notice, last updated October 6, said there was no evidence of exploitation at that time. Previdian subsequently reported matching activity across its global honeypot network. The newer observations increase the urgency for operators of affected appliances, without establishing how many production systems have been attacked successfully.

According to the vulnerability description reproduced by NHS England, the flaw is a pre-authentication server-side request forgery issue in the Appliance Work Place interface. An unintended alternate access path can let a remote attacker make the appliance send requests on their behalf, potentially reaching internal functions and performing unauthorized operations. The assigned CVSS score is 10.0.

NHS England identifies affected hardware and virtual models as SMA1000 6210, 7210 and 8200v. Affected firmware includes 12.4.3-03526 and older versions in that branch, and 12.5.0-02952 and older versions in the other branch. Its alert states that the SMA 100 product line and SSL-VPN on SonicWall firewalls are outside the scope of these vulnerabilities.

SonicWall lists 12.4.3-03670 and 12.5.0-03082, or later versions in the corresponding branches, as the fixed releases. The vendor advises all organizations operating affected physical or virtual SMA1000 appliances to upgrade to the latest hotfix. NHS England likewise urges affected organizations to review advisory SNWLID-2026-0017 and apply the relevant updates as soon as possible.

Previdian recommends reviewing internet-facing exposure and investigating suspicious activity alongside patching. Its alert supplies an observed source IP as an investigative indicator, explicitly warning that it is not proof of compromise. Defenders assessing the October activity should preserve that distinction: honeypot detections support an exploitation-attempt warning, while the available reporting does not confirm successful intrusions.