SonicWall released hotfixes on Tuesday, October 6 for a maximum-severity flaw in its SMA1000 remote access appliances, and said it had no evidence of exploitation. Two days later, Defused’s decoy appliances recorded the first exploit attempts.(we-fix-pc securityweek)

That gap is the whole story. It’s the window your patch process has to beat, and most patch processes weren’t built for it.

SonicWall SMA1000 CVE-2026-102255: What Actually Happened

The flaw is a pre-authentication server-side request forgery (SSRF) in the WorkPlace portal. SonicWall traces it to an unintended access path, and no login is needed to reach it. It carries a CVSS score of 10.0 and affects the 6210, 7210 and 8200v models.(thehackernewsthehackernews)

Here’s the part that should make you uncomfortable. This is the third pre-authentication SSRF disclosed in SMA1000 this year. The July zero-days were abused for weeks to install custom malware. CISA added the September pair to its KEV catalog on September 2. On checks, the appliances fully patched in September were found still vulnerable to this one. (SonicWall SMA1000 CVE-2026-102255: Third Pre-Auth SSRF of 2026 Makes "Patched in September" Out of Date)

Hence, it proves that regular patching doesn’t mean what it used to.

One fair caveat: researchers observed the attempts on honeypots, and successful compromise hasn’t been confirmed. And we can treat that as a head start but not a reason to sleep on, unconsciously.

SSRF Root Cause Analysis: Why a “Simple” Bug Scores a 10.0

SSRF tricks a server into making a request on the attacker’s behalf. The server sits in a trusted position, so its requests get trusted too.

In the observed attempts, attackers sent crafted OPTIONS requests to the WorkPlace interface, trying to make the appliance call a CouchDB service on its own localhost. The appliance ends up talking to itself, and an internal service that was never meant to face the internet gets reached through the front door.

That’s why the score is so high. As SSRF isn’t a break-in, it borrows the trust the device already has. The flaw sits in the one place where “outside” and “inside” meet, and you can’t firewall that away because the appliance in itself is the firewall.

Citrix NetScaler Zero-Days: The Same Lesson on a Different Gateway

NetScaler is telling the same story with different numbers.

CISA added CVE-2026-88779 to KEV on October 4 and gave federal agencies just 3 days, i.e., until October 7 to fix it. On paper it looks modest. It’s rated 8.7, it mostly causes denial of service and it needs the appliance configured for SAML. But CISA warned that attackers can use it to force a reboot and speed up execution of code planted earlier through CVE-2026-88771. A “denial of service” bug can finish an attack that has already started.(CISA Warns of Citrix NetScaler Vulnerability Actively Exploited in Attacks)

Then came CVE-2026-107406, a memory overflow that can give attackers remote code execution, again on SAML-configured appliances. CISA folded it into its updated alert. Citrix hadn’t seen exploitation at last report, but look at the pattern around it: four critical NetScaler advisories in six weeks. And CISA has flagged 27 exploited Citrix vulnerabilities since November 2021, seven of them used in ransomware attacks.(Citrix warns admins to patch new NetScaler RCE flaw immediately)

Australia’s cyber agency was blunter than most. Its guidance in late September was to take affected appliances offline immediately.(cyberdaily)

Why the 48-Hour Window Breaks Traditional Patch Cycles

Most patch programs assume a comfortable sequence: advisory, test, schedule, deploy. That works when attackers need weeks to build an exploit. But for gateways, they don’t. One analyst roundup noted that the gap between a vendor advisory and a KEV listing has shrunk to days across most of 2026.(cybelangel)

Even a good patch doesn’t close the real exposure. Patching fixes the hole from today forward. It says nothing about whether someone walked through it yesterday. CISA’s own directive expects agencies to check for compromises that happened before the patch was applied but again, most teams skip that step.(cisa)

None of this means patching is pointless. It means patching is just the floor, and a floor isn’t a strategy.

Not sure what your edge actually exposes?

This is where we hustle at Thread Security. Our VAPT services (vulnerability assessment and penetration testing) start from the outside, the way an attacker would. We find the gateways, the forgotten test portals and the SAML setups that quietly make you eligible for the next advisory. Then we try to break through them and show you the path, so you’re not guessing. Book a scoping call and we’ll tell you what’s reachable before someone else does.

How to Reduce Zero-Day Risk Before the Next Advisory Drops

You can’t predict the next CVE. You can shrink what it lands on.

1. Inventory every internet-facing gateway. Include the ones a previous team installed and nobody owns. You can’t patch what you can’t name.

2. Check configuration, not just version. Both NetScaler flaws only bite when SAML is enabled. Knowing your preconditions tells you in minutes whether an advisory is your emergency or someone else’s.

3. Watch for appliances talking to themselves. SSRF shows up as odd requests between an appliance and its own internal services. Log sources that capture source and destination make it visible.
4. Hunt backward after patching. Assume the window already opened and look for web shells, new accounts and strange outbound connections.
5. Test the perimeter continuously. An annual penetration test is a photograph of a moving target. An external attack surface audit tied to regular testing catches drift between photographs.

Frequently Asked Questions

What is an SSRF vulnerability, in plain terms?
It lets an attacker make a trusted server send requests for them, often to internal systems the attacker can’t reach directly.

Why do VPN and application gateways get targeted so often?
They sit on the edge, they’re reachable from the internet, and a single compromise can open the way into the internal network.

Is patching enough to stop zero-day attacks?
No. Patching closes the flaw going forward but can’t undo earlier compromise. You also need exposure checks and testing that finds weaknesses before attackers do.

The Takeaway

Gateways will keep failing because they carry too much trust in too exposed of a place. Your defense is knowing your own edge better than an attacker does and checking it more often than they check it is an essential key.

If you’d rather find that out from us than from an incident report, talk to Thread Security about a VAPT engagement. We’ll show you what an attacker sees, in plain language and with a plan to fix it.