SonicWall SMA1000: critical flaw CVE-2026-102255 already targeted in attacks

On October 9, BleepingComputer reported the first attempts to exploit a critical vulnerability in SonicWall SMA1000 remote access gateways. The flaw, tracked as CVE-2026-102255, was patched by the vendor on Tuesday, October 6, in its security advisory SNWLID-2026-0017. SonicWall gives it the maximum severity score, 10 out of 10 on the CVSS (Common Vulnerability Scoring System) scale.

A flaw exploitable without authentication

It is a SSRF (server-side request forgery) flaw in the Appliance WorkPlace interface. According to SonicWall, a remote, unauthenticated attacker can cause the device to send requests on their behalf. This lets them reach internal services that are normally inaccessible from the internet.

The affected models are the SMA1000 6210, 7210 and 8200v, in physical or virtual form. According to BleepingComputer, the SSL VPN feature of SonicWall firewalls and the SMA 100 series are not affected. SonicWall's advisory also fixes three other flaws: an operating system command injection (CVE-2026-102256), a directory traversal (CVE-2026-102257) and an XSS flaw (CVE-2026-102258). However, these three require authentication.

Attempts already detected

In its advisory, SonicWall said it had no evidence of exploitation. But Ryan Dewhurst, founder of the company Previdian, told BleepingComputer that his honeypot network had spotted attempts matching this flaw. He describes a request targeting an internal CouchDB service, using the credentials admin:admin. Previdian says it does not know whether these attempts would have compromised real systems.

According to the Shadowserver Foundation, more than 400 SMA1000 devices are exposed on the internet. Some may already be patched, or may be mere decoys.

The context calls for caution. According to Ryan Dewhurst, quoted by BleepingComputer, the WorkPlace interface was already hit by SSRF flaws in July (CVE-2026-15409) and in September 2026 (CVE-2026-83548), exploited as zero-days, meaning before any patch was available. CISA, the US cybersecurity agency, has linked some of these attacks to ransomware gangs. It has added 19 SonicWall flaws to its Known Exploited Vulnerabilities (KEV) catalog in four years.

What to do

• Update immediately to the patch released by SonicWall. SonicWall lists versions 12.4.3-03670 and 12.5.0-03082 or later (advisory SNWLID-2026-0017).
• Restrict exposure of the WorkPlace interface and the administration console to only the addresses that need access.
• Review logs for unusual requests, especially OPTIONS requests targeting internal services.
• If in doubt, rotate the credentials stored on or used by the device.