SonicWall has patched CVE-2026-102255, a CVSS 10.0 pre-authentication server-side request forgery in the WorkPlace interface of its SMA1000 secure remote access appliances (advisory SNWLID-2026-0017). Honeypot operators began logging exploitation attempts roughly two days after the fix shipped, and one telemetry provider counted 135 attempts from two US-based IP addresses by October 12. No confirmed compromise has been publicly reported, and as of October 12 SonicWall had not updated its advisory to confirm in-the-wild exploitation. Treat this as an actively probed, patch-now flaw on a product line that has been hit repeatedly this year.

Technical details

According to the Cloud Security Alliance’s research note and press coverage, the flaw stems from an unintended alternate access path in the WorkPlace web interface. An unauthenticated remote attacker can make the appliance issue requests it was never meant to expose to the outside, reaching services bound to loopback.

The observed traffic targets an internal CouchDB instance on 127.0.0.1:5984. Requests use crafted OPTIONS calls carrying a hardcoded admin:admin Basic authorization header, which suggests attackers are betting on default internal credentials once the SSRF reaches the database. CouchDB holds appliance configuration and session-related data, so successful access could expose or alter state on a device that sits at the network edge and brokers remote access to internal resources. We have not seen confirmation of what, if anything, was retrieved.

Reports differ on how strongly to frame the activity. Previdian’s honeypots and Defused’s SMA decoys both recorded hits. No public proof-of-concept had been reported as of early October, so the attempts appear to derive from patch diffing or private exploit development rather than a published exploit.

Affected versions

  • SMA1000 builds 12.4.3-03526 and earlier
  • SMA1000 builds 12.5.0-02952 and earlier
  • Models: SMA 6210, 7210 and 8200v
  • Fixed: 12.4.3-03670 and later releases

SMA 100 series appliances and SonicWall firewall SSL-VPN are reported as unaffected.

Why this matters

This is not the first SMA1000 emergency this year. We previously covered the CVE-2026-15409/15410 SSRF-to-RCE chain and the CVE-2026-83548/83549 chained zero-days. SSRF in the same WorkPlace and management surface keeps recurring, and each time the fast follow-on exploitation window is measured in days. An SMA1000 compromise gives an attacker a foothold on an authenticated, trusted VPN gateway, positioned to harvest credentials, tokens and internal routes.

A CVSS 10.0 pre-auth bug with attempts already in the wild and a short patch-to-probe window means edge-device operators should assume scanning is ongoing against any exposed WorkPlace interface.

Mitigation

  1. Patch now. Upgrade to 12.4.3-03670 or the corresponding fixed 12.5.x release per SNWLID-2026-0017.
  2. Restrict exposure. If you cannot patch immediately, limit access to the WorkPlace interface to known source ranges or place it behind an upstream filter. The management interface should never be internet-reachable.
  3. Hunt for probing. Search web and appliance logs for OPTIONS requests to WorkPlace paths that proxy to loopback, any references to port 5984, and Authorization: Basic headers decoding to admin:admin. Look back to at least October 6.
  4. Check for post-exploitation. Review appliance configuration for unexpected changes, new administrators or accounts, altered authentication or portal settings, and unexplained outbound connections from the device.
  5. Rotate secrets that live on or transit the appliance (local accounts, service credentials, certificates, API tokens) if you find signs of access, and invalidate active sessions.
  6. Monitor the advisory. SonicWall may update the advisory with exploitation status and indicators; subscribe to the PSIRT feed.

References

  • SonicWall PSIRT advisory SNWLID-2026-0017
  • Cloud Security Alliance research note: SonicWall SMA1000 SSRF exploitation, October 2026
  • The Hacker News, BleepingComputer, Security Affairs and eSecurity Planet coverage, October 6-13, 2026