SUSE fixed Rancher security vulnerabilities, including Rancher credential leak CVE-2026-88811, an SSRF flaw, and an unauthorized shell bypass. Update now.
Security Blind Spots Identified by AI The large-scale data breaches disclosed in quick succession in South Korea and Japan in October 2026 mostly originated not from internal core systems, but from peripheral entry points such as externally exposed web services, app backend APIs, and outsourced SaaS (services provided by third-party vendors via the cloud, such […]
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after its public disclosure.
Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.0), just days after public disclosure. The vulnerability is a server-side request forgery (SSRF) flaw that requires no login. Attackers could abuse it to make the appliance send requests and access internal functions, allowing unauthorized actions.
“A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path.” reads the advisory. “By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
The vendor said it has found no evidence of exploitation, but recommends applying the fixes.
The vulnerability affects the following product and versions:
Affected Product
Affected Version(s)
SMA1000 Models – 6210, 7210, 8200v
12.4.3-03526 (platform-hotfix) and older versions. 12.5.0-02952 (platform-hotfix) and older versions.
The company pointed out that the flaws do not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
The hotfix is available through the MySonicWall portal, the vendor pointed out that there is no workaround.
Multiple researchers warn the vulnerability is now being actively exploited. Cybersecurity firm Defused has detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys since October 8, 2026. Defused alerted subscribers through its Radar service.
Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate access path SSRF, CVSS 10.0) was disclosed earlier this week by SonicWall. We notified Defused subscribers of the anomalous traffic via our Radar… pic.twitter.com/h0w30YT0Y3
Cybersecurity firm Previdian also announced that its sensors have detected exploitation attempts targeting SonicWall SMA 1000 appliances, consistent with CVE-2026-102255. The reported attacker IP is 146.70.143[.]142.
SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0).
The vulnerability allows unauthenticated server-side request forgery (SSRF).
According to Previdian, researchers have recorded 135 attack attempts from two IP addresses in the United States. Researchers have recorded 135 attempts from two different IP addresses in the United States. SonicWall has not yet updated its security advisory to confirm that attackers are exploiting the flaw.
Attackers target a critical SonicWall SMA1000 vulnerability in the wild. Apply vendor hotfixes to secure remote access gateways against CVE-2026-102255.
Note The July 2026 Dark Web Breach Incident Trend Report was compiled based on data breach cases posted on deep web and dark web forums. Due to the nature of some posts, it is difficult to fully verify their accuracy; some posts related to South Korea included AI-generated false data or cases where it could […]
Entrar
Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys. CVE-2026-102255 (alternate access path SSRF, CVSS 10.0) was disclosed earlier this week by SonicWall. We notified Defused subscribers of the anomalous traffic via our Radar… 