Summary

SonicWall has patched CVE-2026-102255, a pre-authentication Server-Side Request Forgery flaw in the WorkPlace portal of its Secure Mobile Access (SMA) 1000 appliances, rated at the maximum CVSS score of 10.0. An unintended alternate access path in the portal lets an attacker with no login make the appliance send requests on their behalf, reaching internal systems and performing actions meant only for authenticated users.

SonicWall released hotfixes on October 6, 2026, for models 6210, 7210, and 8200v, and said at the time there was no sign of exploitation. Later, on October 8, researchers saw exploitation attempts against their decoy systems, recording 135 attempts from two US-based IP addresses. The fix is already available, though, and attackers are clearly looking for unpatched gateways, so organizations running affected SonicWall SMA 1000 appliances should upgrade to platform-hotfix 12.4.3-03670 or 12.5.0-03082 or later without waiting for the next change window.

Affected Products

CVE

Vulnerability Details

1. #01

   CVE-2026-102255 is a pre-authentication Server-Side Request Forgery vulnerability, classified under CWE-918, affecting the WorkPlace interface of SonicWall SMA 1000 appliances. The WorkPlace interface is the web-based portal that remote users connect to, which means it is exposed to the internet as a matter of normal deployment rather than misconfiguration. SonicWall assigned the flaw a CVSS score of 10.0, the maximum possible.

2. #02

   The root cause is an unintended alternate access path within the WorkPlace interface. In plain terms, the portal exposes a route that was never meant to be reachable the way it is, and that route accepts input which the appliance then uses to build and send its own outbound requests. Because the appliance is a trusted device sitting inside the network perimeter, those requests carry its trust with them. An attacker does not gain a shell or a login; instead, they gain the ability to make a trusted machine ask questions on their behalf, and the internal services on the receiving end answer as though the request were legitimate.

3. #03

   Exploitation works by sending a crafted request to the internet-facing portal, which pushes the appliance into making requests against internal endpoints that trust it, allowing the attacker to perform actions normally reserved for logged-in users or administrators. In the activity observed against honeypots and decoy systems, that took the shape of OPTIONS requests directed at the WorkPlace Extraweb interface and aimed at an internal CouchDB service listening on the appliance's own loopback interface, accompanied by references to CouchDB design-document and rewrite functionality and an authorization header containing default administrative credentials. Researchers have described these as hunting leads rather than confirmed indicators of compromise, and it remains unknown whether the same requests succeed against real SMA 1000 deployments as opposed to decoys.

4. #04

   The vulnerability affects SMA 1000 models 6210, 7210, and 8200v, covering both physical appliances and supported virtual deployments. Platform-hotfix builds 12.4.3-03526 and earlier and 12.5.0-02952 and earlier, are vulnerable, and SonicWall advises verifying the exact platform-hotfix level rather than relying on the main firmware branch alone, since branch numbers alone will not tell an administrator whether the fix is present. SonicWall has confirmed that SSL-VPN services running on its firewall products and the discontinued SMA 100 Series line are not affected. On the exploitation question, the timeline is worth stating precisely: SonicWall published the advisory and hotfixes on October 6, 2026, stating there was no evidence of in-the-wild exploitation at that point; observed exploitation attempts beginning October 9-10, 2026; and has since recorded 135 attempts from two unique US-based IP addresses.

Vulnerability

Recommendations

1. 01
   Apply the SonicWall Hotfix Now

   Upgrade affected SMA 1000 appliances to platform-hotfix 12.4.3-03670 or later, or 12.5.0-03082 or later, depending on which branch you run. Check the exact platform-hotfix build rather than the firmware branch, because a device on the right branch can still be on a vulnerable build. This is the only step that actually closes the vulnerability; everything else below reduces risk around it.

2. 02
   Confirm What Is Actually Exposed

   Inventory every physical and virtual SMA 1000 appliance in your estate, including any managed on behalf of customers, and confirm which ones present the WorkPlace interface to the internet. Appliances inherited through acquisitions, lab deployments, and service-provider estates are the ones that typically get missed, and an unpatched gateway nobody owns is the most likely way this flaw reaches you.

3. 03
   Limit Where the Appliance Can Reach

   Until patching is complete across the estate, restrict unnecessary exposure of the WorkPlace interface, isolate the Appliance Management Console from public and user-facing networks, and limit the appliance's outbound access to only the internal services it genuinely needs. Preventing it from reaching databases, directories, and management systems it has no business talking to shrinks what an SSRF can accomplish, though it does not remove the flaw.

4. 04
   Do Not Assume a Patched Appliance Is a Clean One

   If an appliance was internet-facing before the hotfix was applied, preserve its logs and relevant evidence before making changes, investigate the internal systems it could reach, and rotate credentials, session material, and authentication secrets that may have been exposed. Patching closes the door, but it does not tell you whether anyone walked through it first.

5. 05
   Vulnerability Management

   Maintain an accurate inventory of appliance models, firmware branches, and platform-hotfix levels so that vendor advisories can be mapped to your estate in hours rather than days. Build edge and boundary devices into a prioritized patch track separate from general IT patching, since SSL-VPN and secure access gateways have been among the most consistently targeted asset classes in recent years and routinely see exploitation attempts within days of disclosure.

6. 06
   Reduce Long-Term Reliance on Legacy Edge Access

   Where feasible, plan a migration from legacy SSL-VPN concentrators to zero-trust network access models that don't rely on a single internet-facing appliance with broad internal reach. This is a strategic, not immediate, step, but repeatedly targeting this device class makes architectural dependency on it a standing risk rather than a one-off incident.

MITRE ATT&CK TTPs

References & Patch Links

Patch Link

• SNWLID-2026-0017https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017

References

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
• https://previdian.com/CVE-2026-102255#telemetry
• https://x.com/DefusedCyber/status/2108543042693058984