Guyana’s National Computer Incident Response Team (CIRT) issued an advisory on vulnerabilities in SonicWall SMA1000 remote access appliances. The flaw, tracked as CVE-2026-102255, allows remote attackers without login credentials to make the appliance send requests on the attacker’s behalf and reach internal functions and perform unauthorized operations. The affected products are SMA1000 Models 6210, 7210 and 8200v. The SMA 100 Series product line and SSL-VPN running on SonicWall firewalls are not impacted.
In an October 9 interview with BleepingComputer, Previdian founder and security researcher Ryan Dewhurst said the company’s honeypots had detected requests consistent with exploitation attempts, but researchers had not established whether the attempts would have successfully compromised systems.
Although there are no identified or confirmed cases of compromised systems throughout the Caribbean, Guyana’s national team is asking users and administrators to review the update and apply the latest hotfix version where necessary. In addition to investigating and documenting any suspicious activity, leaders should also have their IT team or provider:
Confirm the exact model
Specify the installed software
Initiate the applicable fixed release
Updating the appliance addresses the known weakness; determining whether it was previously targeted is a separate task.
WHY THIS MATTERS: For Caribbean organizations using affected SMA1000 gateways, reported attack attempts make remote access maintenance an immediate operational question.
TAKEAWAY: Obtain a documented exposure and update assessment for each affected gateway, with an owner for investigating suspicious activity.
