SonicWall SSRF bug rated 10.0 exploited in SMA1000 Appliance Work Place

What happened

SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.” “There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild,” the vendor said , but the one mentioned above could soon be, given attackers’ track record with similar flaws.

Attackers are now exploiting a CVSS 10.0 server-side request forgery (SSRF) flaw in SonicWall’s SMA1000 Appliance Work Place.

What changed

As of Friday, CVE-2026-102255 was not yet added to the known exploited vulnerabilities list by the Cybersecurity and Infrastructure Security Agency (CISA), but security pros said that heading into the weekend, teams should not wait.

In its advisory on Tuesday, SonicWall did not say if the bug was actively exploited, but security researchers at Previdian said that the company’s honeypots had detected exploitation.

Who is affected

In 2026, two pre-authentication server-side request forgery flaws ( CVE-2026-15409 , CVE-2026-83548 ) in SonicWall’s SMA 1000 appliances have been leveraged as zero-days.

CVE-2026-102257 and CVE-2026-102258 – a path traversal and a cross-site scripting flaw in the appliances’ Appliance Management Console, respectively – are exploitable only if the attacker is authenticated as administrator.

Why it matters

CVE-2026-102255 is a pre-authentication SSRF vulnerability in the SMA 1000 Appliance Work Place interface, due to an unintended alternate access path.

If teams can’t patch before the weekend, isolate the Appliance Work Place interface from public internet access.

Technical details

Soroko pointed out that researchers said they observed exploitation attempts consistent with the flaw, but have not confirmed that those attempts succeeded.

CVE-2026-102255 and CVE-2026-102256, a post-authentication OS command injection flaw, were reported by Benoît Sevens.

Defused Cyber flagged exploit attempts starting on October 8, but it’s currently unknown whether these are successful when leveraged against actual SonicWall SMA 1000 deployments.

Response

Before the weekend, Soroko said teams should identify affected SMA1000 appliances, install SonicWall’s update and verify that each device is running the fixed software.

Heading into the weekend, Barney said security teams running affected SonicWall SMA1000 models (6210, 7210, and 8200v) should apply the vendor hotfixes immediately rather than relying on workarounds.

What security teams should do

Barney said teams should also review logs originating from these appliances for anomalous outbound or internal requests, as SSRF exploits typically serve as the initial vector for lateral movement, credential harvesting and secondary access attempts.

If teams can’t patch an appliance today, Soroko said take it off the internet until it can: preserve and review logs for suspicious requests, configuration changes and unexpected connections.

What remains unknown

In its advisory on Tuesday, SonicWall did not say if the bug was actively exploited, but security researchers at Previdian said that the company’s honeypots had detected exploitation.

Defused Cyber flagged exploit attempts starting on October 8, but it’s currently unknown whether these are successful when leveraged against actual SonicWall SMA 1000 deployments.

Attribution

SC Media: Attackers are now exploiting a CVSS 10.0 server-side request forgery (SSRF) flaw in SonicWall’s SMA1000 Appliance Work Place.

Help Net Security: SonicWall has patched four vulnerabilities in its popular Secure Mobile Access (SMA) 1000 series of appliances, including one (CVE-2026-102255) that could allow remote unauthenticated attackers “to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.” “There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild,” the vendor said , but the one mentioned above could soon be, given attackers’ track record with similar flaws.

What to watch next

Watch for new exploitation reports and updated indicators of compromise.

Watch for updated vendor guidance and fixed-version details.