What happened
On October 6, 2026, SonicWall shipped fixes for four flaws in its SMA1000 remote access gateways. The worst, CVE-2026-102255, scores CVSS 10.0: an unauthenticated server-side request forgery (SSRF) in the Appliance Work Place interface, the portal users log in to. At the time SonicWall said it had no evidence of exploitation.
Three days later, on October 9, Previdian founder Ryan Dewhurst told BleepingComputer the firm's honeypots detected exploitation attempts consistent with the flaw. Per ctipilot, Previdian counted 135 attempts from two addresses between Oct 9 and 10.
Status: attack attempts observed, but no confirmed compromise as of October 10. SonicWall's advisory still said no evidence of exploitation, and CISA had not added it to KEV.
How the attack works
With SSRF, the attacker uses the appliance as a messenger to reach internal services never meant to be reachable from outside. Observed requests sent an OPTIONS to the Extraweb interface, trying to reach the internal CouchDB (127.0.0.1:5984) and invoke its _rewrite function with admin:admin credentials.
Denis Calderone, CTO of Suzu Labs, told SC Media there is already a public Metasploit module from the September chain showing how to turn CouchDB access into root code execution, and the internal architecture hasn't changed.
Third time in 2026
It is the third CVSS 10 pre-auth SSRF in the Work Place interface in nine months:
- July: zero-days CVE-2026-15409 and 15410 exploited to plant malware (Sou5, OrangeTail, RootRun); CISA tied intrusions to ransomware operators.
- September: CVE-2026-83548 and 83549 chained for remote code execution.
- October: CVE-2026-102255. Per Calderone, the September firmware is exactly what's vulnerable: anyone who patched in September is exposed again.
Who is affected
SMA 6210, 7210 and 8200v. It does not affect the SMA 100 series or SSL-VPN on SonicWall firewalls. Shadowserver tracks more than 400 exposed SMA1000s (a count that may include honeypots and patched units).
What to do now
- Upgrade to 12.4.3-03670 or 12.5.0-03082. There's no workaround.
- Plan a window: the appliance reboots and drops all VPN sessions. Don't apply it over the VPN itself.
- Restrict exposure of the management interface.
- Hunt for anomalous internal CouchDB access and unusual logins, since SonicWall published no IOCs.
- If you use an MSP, ask today whether your SMA1000s are updated.
- Rethink the strategy: three max-severity flaws in nine months justify considering alternatives like Zero Trust Network Access.
Sources
- BleepingComputer (9/10/2026): https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
- SC Media: https://www.scworld.com/news/10-0-sonicwall-ssrf-bug-now-exploited-in-sma1000-appliance-work-place
- Cyber Unit: https://cyberunit.com/insights/sonicwall-sma1000-cve-2026-102255-remote-access-gateway/
- CySecurity News: https://www.cysecurity.news/2026/10/attackers-are-already-exploiting.html
Running SonicWall VPN or another remote access gateway? KGA IT offers a free consultation: kga-it.com.