The patch for CVE-2026-102255 shipped on Tuesday. By Friday, BleepingComputer reported that attackers were already exploiting it on SonicWall SMA1000 appliances, a flaw carrying the maximum severity rating.

Three days. For most organisations that is not enough time to finish a change request.

An SMA1000 sits at the edge, which is where remote staff and contractors authenticate. A bug rated at the top of the scale on a device built to face the internet is the combination that change-advisory boards exist to rush, and rarely do. The usual sequence is a Tuesday advisory, a Thursday test cycle, a Sunday maintenance window and a Monday ticket closure. The attackers did not wait for the ticket.

We covered Fortinet's FortiMail flaw, CVE-2026-104286, on 2 October, where the vendor said code was already running on customer systems before anyone had a fix. That one gave defenders no head start. This one gave them one, and the head start lasted until Friday.

By our count, four flaws on our tracked list entered CISA's Known Exploited Vulnerabilities catalogue in the seven days to 9 October, out of 250 we follow. The SonicWall bug is a reminder of the other kind of risk: a fix already published, and the exposure sitting in the gap before it is applied.

The check takes minutes. Pull the firmware version from every SMA1000 in the estate, compare it against Tuesday's release, and read the appliance's authentication and admin logs back to Tuesday for anything that does not belong to a person you can name. Where the box cannot be patched this weekend, taking its management interface off the internet is the control that changes the outcome. A weekly window cannot.