Attackers Exploit Maximum-Severity SonicWall SMA1000 Flaw Three Days After Patch

A maximum-severity flaw in SonicWall's SMA1000 remote access appliances, tracked as CVE-2026-102255, is now being exploited in attacks, BleepingComputer reports. The patch shipped on Tuesday. By Friday, attackers were already using the bug against devices that had not yet been updated.

Kai Tanner's desk has the detail. An SMA1000 sits at the edge of a company's network, the place where remote staff and contractors sign in, so a top-rated bug on a device built to face the internet is about as valuable as a flaw gets. Three days is not long enough to finish most change requests. It was evidently plenty for the other side.

The contrast with Kai Tanner's earlier coverage is useful. The Fortinet FortiMail flaw, CVE-2026-104286, which the desk covered on 2 October, was being exploited before any fix existed, so defenders had no head start at all. This time they had one, and it ran out on Friday. By the desk's count, four flaws on its tracked list entered CISA's Known Exploited Vulnerabilities catalogue in the seven days to 9 October, out of 250 followed.

Elsewhere, Cheung Kwok-keung of the HK Desk has the One Stanley developer's six-year structural warranty and free inspections, offered while the steel bar investigation stays open. Joy Lee has the Warner film chiefs leaving under Skydance, and David Zaslav departing with $606 million. Dev Chatterjee has the winless Buccaneers beating the Cowboys 24-16 in Dallas.

Back to SonicWall, the point is plain. Publishing a fix does not close a vulnerability. It starts a race between the people who must test and schedule the update and the people who can read the advisory and build an attack from it. Once the patch is public, the flaw is public too, and the weekly maintenance window is the stretch of time in which a company is exposed.