Key points
- CVE-2026-102255 is a pre-authenticated SSRF flaw with a CVSS score of 10.0.
- Exploitation attempts were detected by threat intelligence firms two days after disclosure.
- The vulnerability affects SMA1000 6210, 7210, and 8200v models running specific software versions.
The short version
- Attackers are actively exploiting a critical server-side request forgery flaw in SonicWall SMA1000 appliances.
- The vulnerability, tracked as CVE-2026-102255, allows unauthenticated remote attackers to perform unauthorized operations.
- SonicWall released patches on 6 October 2026, but exploitation attempts were observed by 8 October 2026.
The details
Threat actors have begun exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances shortly after the vendor issued a patch. The flaw, identified as CVE-2026-102255, carries a CVSS score of 10.0 and is classified as a pre-authenticated server-side request forgery (SSRF) issue. According to SonicWall, the defect exists in the Appliance WorkPlace interface and affects the 6210, 7210, and 8200v models. It does not impact the SMA 100 Series product line or SSL-VPN services running on SonicWall firewalls. The vendor released software updates, versions 12.5.0-03082 and 12.4.3-03670, on 6 October 2026 to address the issue.
Despite the availability of a fix, exploitation attempts were detected within days. Threat intelligence firms Previdian and Defused reported observing unauthenticated SSRF traffic targeting their SonicWall SMA decoys on 8 October 2026, just two days after public disclosure. Previdian recorded 135 attempts originating from two unique IP addresses located in the United States. Ryan Dewhurst, founder of Previdian, noted that the requests targeted the WorkPlace Extraweb interface using a crafted OPTIONS request. The payload attempted to access the appliance’s internal CouchDB service at 127.0.0.1:5984 and invoke a design document function.
SonicWall has not yet updated its advisory to confirm active exploitation in the wild. The company stated that a remote unauthenticated attacker could potentially abuse this path to direct the appliance to issue requests on their behalf. This would allow the attacker to reach internal functionality and perform unauthorized operations. While the activity is consistent with active exploitation, Previdian has not confirmed whether these attempts successfully compromised any systems. Defused also confirmed the observation of unauthenticated SSRF traffic against their decoys since the previous day.
The context
The SMA1000 enterprise-grade secure remote access gateways are frequently targeted because Managed Service Providers, large corporations, and government agencies use them for VPN access to internal applications and corporate networks. This vulnerability is part of a broader trend of attacks against SonicWall SMA 1000 appliances. In June 2026, threat actors dubbed UTA0533 weaponised two other flaws, CVE-2026-15409 and CVE-2026-15410, as zero-days to deploy Java web shells and malware called KNUCKLEBALL. Rapid7 reported that those actors used the appliances as an initial access vector to execute commands and establish persistent access.
Once inside, the threat actors extracted high-value credentials, active session databases, and Time-Based One-Time Password (TOTP) multi-factor authentication seed configurations. They then pivoted from the compromised appliance into the internal corporate network. The current vulnerability, CVE-2026-102255, affects the same WorkPlace interface targeted by earlier SSRF vulnerabilities disclosed in July and September 2026, but it uses a different exploitation technique. Internet threat watchdog Shadowserver tracks more than 400 SMA1000 appliances exposed online, though it is unclear how many are honeypots or patched.
Defender's checklist
Organisations using SonicWall SMA1000 appliances should verify their software versions immediately. The vulnerability affects models 6210, 7210, and 8200v. Users should ensure they have applied the platform-hotfix updates 12.5.0-03082 or 12.4.3-03670 released on 6 October 2026. Security teams should monitor for unusual OPTIONS requests targeting the WorkPlace Extraweb interface.
Background: Honeypots
Isolate a virtual system from production networks, configure it to mimic common services, and monitor all access attempts. Verify connectivity through controlled scans, then integrate logs with your existing monitoring stack to detect unauthorized interactions without risking real assets.
Read the full guide: Deploy Honeypots: A Step-by-Step Implementation Plan
What to do and how to stay safe: SonicWall
- Verify that all SMA1000 6210, 7210, and 8200v appliances are updated to software versions 12.5.0-03082 or 12.4.3-03670.
- Monitor network traffic for unauthenticated OPTIONS requests targeting the WorkPlace Extraweb interface or internal CouchDB services.
- Review access logs for attempts to reach internal functionality or invoke design document functions from external IP addresses.
- Isolate any compromised appliances from the internal network to prevent lateral movement and credential theft.
Step-by-step guide: Unpatched Software: Why Missing Updates Create Hidden Entry Points
General security guidance from the Cipher Insider newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SonicWall models are affected by CVE-2026-102255?
The vulnerability affects the SMA1000 6210, 7210, and 8200v models. It does not affect the SMA 100 Series or SSL-VPN on SonicWall firewalls.
Has SonicWall confirmed that the flaw is being exploited in the wild?
SonicWall has not yet updated its advisory to reflect active exploitation, though threat intelligence firms have detected attempts.
What software versions fix this vulnerability?
SonicWall released patches in software versions 12.5.0-03082 and 12.4.3-03670 on 6 October 2026.
