CVE-2026-102255: Critical SonicWall SMA1000 SSRF

SonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances.

The flaw can allow an unauthenticated remote attacker to make the appliance issue requests toward internal functionality. SonicWall released fixed hotfixes on October 6, while researchers later reported exploitation attempts against honeypot and decoy systems.

What Is CVE-2026-102255?

CVE-2026-102255 (CVSS 10.0) is an SSRF vulnerability caused by an unintended alternate access path in the SMA1000 WorkPlace interface.

According to SonicWall, a remote unauthenticated attacker may be able to direct the appliance to send requests on their behalf, reach internal functionality, and perform unauthorized operations.

In practical terms, the internet-facing gateway can potentially act as a proxy into services that would not normally be reachable externally.

The available evidence does not establish that CVE-2026-102255 independently provides Remote Code Execution (RCE), persistence, credential theft, or complete appliance compromise. Its impact depends on which internal services the SMA1000 can reach and what those services allow.

Which SonicWall SMA1000 Versions Are Affected?

The vulnerability affects SMA1000 6210, 7210, and 8200v appliances, including supported virtual deployments.

SonicWall says the SMA 100 Series and SSL-VPN services running on SonicWall firewalls are not affected.

Organizations should verify the exact platform-hotfix level rather than relying only on the main firmware branch. SonicWall lists the affected and fixed builds in its SMA1000 security notice (SNWLID-2026-0017).

Why Is the Vulnerability High Risk?

SMA1000 appliances typically sit between the internet and internal applications, identity infrastructure, and other enterprise services. If the WorkPlace interface can be abused to send internal requests, an attacker may be able to interact with services that were never intended to be internet-accessible.

Segmentation and restrictive outbound access can reduce the impact, but they do not remove the vulnerability.

Is CVE-2026-102255 Being Exploited?

Exploitation attempts have been observed, but successful compromise of production systems has not been publicly established.

SonicWall’s October 6 notice stated that it had no evidence that CVE-2026-102255 or the other vulnerabilities in the release were being exploited in the wild. That assessment was followed by new researcher observations. Previdian said that its honeypot network detected requests consistent with CVE-2026-102255 exploitation attempts. Defused also observed related activity against SonicWall decoys.

The observed traffic reportedly targeted the WorkPlace Extraweb interface with crafted OPTIONS requests intended to reach an internal CouchDB service at 127.0.0[.]1:5984. Researchers also observed references to CouchDB design-document functionality and an authorization header containing admin:admin.

Is a Public PoC Available?

No public proof-of-concept (PoC) was reported as of early October. Published research describes observed attack patterns, but those details should not automatically be treated as reliable weaponized exploit code.

Track CVE-2026-102255 with SOCRadar

Powered by SOCRadar’s Cyber Threat Intelligence module, Vulnerability Intelligence can help teams track exploit activity, remediation updates, and changes in CVE-2026-102255’s threat status. Combined with Attack Surface Management, organizations can identify internet-facing SMA1000 assets, validate vulnerable hotfix levels, and prioritize systems with broad access to internal services.

What Should Defenders Do?

Apply SonicWall’s Hotfixes

Upgrade affected appliances to:

• 12.4.3-03670 or later
• 12.5.0-03082 or later

SonicWall strongly advises all organizations running affected physical or virtual SMA1000 appliances to install the latest hotfix.

Reduce Internal Reachability

Until patching is complete:

• Restrict unnecessary exposure of the WorkPlace interface.
• Isolate the Appliance Management Console from public and user-facing networks.
• Limit outbound appliance access to required internal services.
• Prevent unnecessary connectivity to databases, directories, and management systems.

These controls reduce risk but do not replace the update.

Hunt for Suspicious Activity

Review WorkPlace and Extraweb telemetry for:

• Unusual OPTIONS requests.
• Requests targeting 127.0.0[.]1:5984 or other internal-only services.
• CouchDB design-document or _rewrite references.
• Unexpected outbound connections from the appliance.
• Authentication, configuration, or administrative changes following suspicious requests.

These are hunting leads rather than confirmed indicators of compromise.

If suspicious activity is found, preserve logs and relevant appliance evidence, investigate connected internal systems, and consider rotating credentials or authentication material that may have been exposed.

Patching closes the known vulnerability, but an appliance that was exploited before remediation should not automatically be considered clean.