SonicWall SMA 1000 SSRF flaw exploited after patch (CVE-2026-102255)

A critical SonicWall SMA 1000 vulnerability, CVE-2026-102255, is being targeted by attackers just days after SonicWall released a fix on October 6, 2026. The flaw is a pre-authentication server-side request forgery (SSRF) bug with a CVSS score of 10.0. Threat intelligence firms report exploitation attempts, but SonicWall has not yet updated its advisory to say the flaw is exploited, according to The Hacker News.

The vulnerability is not listed in CISA’s Known Exploited Vulnerabilities (KEV) catalog in the data available to us at the time of writing. Treat that as a gap in listing, not a sign of safety.

What happened

SonicWall disclosed CVE-2026-102255 on October 6, 2026 and shipped platform hotfixes the same day. Defused Cyber said its SMA decoys received the first exploitation attempts on October 8, two days after disclosure. Previdian (formerly KEVIntel) also reported exploitation attempts against the bug.

According to Previdian data cited by The Hacker News, 135 attempts have been observed so far, coming from two unique IP addresses located in the United States. The IP addresses have not been published in the sources we reviewed.

SonicWall describes the issue as an unintended alternate access path in the Work Place interface. By abusing it, a remote unauthenticated attacker could direct the appliance to issue requests on their behalf and reach internal functionality, performing unauthorized operations. Horizon3.ai warned that successful exploitation could let attackers take over vulnerable devices.

Am I affected? SonicWall SMA 1000 versions

SecurityWeek reports that SonicWall urged owners of these models to update:

• SMA 6210
• SMA 7210
• SMA 8200v

The fixed builds are:

• 12.4.3-03670 (platform-hotfix)
• 12.5.0-03082 (platform-hotfix)

The exact list of vulnerable versions is not disclosed in the structured vulnerability data we have. Check the SonicWall advisory SNWLID-2026-0017 to confirm whether your build is in scope.

Technical details

• Type: pre-authentication SSRF in the Work Place interface of the SMA1000 appliance (SSRF means the server is tricked into making requests the attacker could not make directly).
• Weakness classes: CWE-441 and CWE-918.
• CVSS 3.1: 10.0 (CRITICAL), vector CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. That means network reachable, low complexity, no privileges, no user interaction, changed scope and high impact on all three pillars.
• EPSS: 0.00477, a low modelled probability, though real exploitation attempts are already reported.
• NVD publication: October 7, 2026.
• CISA KEV: not listed in our data.

Why this matters

Analysis, not new facts. SMA appliances sit on the network edge and are built to bridge outside users to internal resources. An SSRF on a device like that can turn the appliance into a stepping stone to internal systems, which is why a CVSS 10.0 with no authentication deserves emergency treatment.

This is also not the first time this product line has been hit. According to The Hacker News, two other SMA 1000 flaws (CVE-2026-15409, CVSS 10.0, and CVE-2026-15410, CVSS 7.2) were used as zero-days in June 2026 by a threat actor tracked as UTA0533, who deployed Java web shells and malware called KNUCKLEBALL. Rapid7 said the actors then extracted credentials, active session databases and TOTP multi-factor authentication seed configurations before moving laterally into the internal network. The sources do not link the new attempts to that actor.

If your appliance is internet-facing and unpatched, plan as if it could already have been probed. The window between patch and exploitation here was about two days.

What to do: fix CVE-2026-102255

1. Identify every SMA 1000 appliance (6210, 7210, 8200v) and record its build version.
2. Install platform hotfix 12.4.3-03670 or 12.5.0-03082, whichever matches your release train, within hours rather than days.
3. Read advisory SNWLID-2026-0017 for any workaround guidance. Workarounds are not described in the sources we reviewed.
4. Review appliance and upstream firewall logs from October 6 onward for unexpected requests to the Work Place interface and unusual outbound or internal connections originating from the appliance.
5. Because the June 2026 attacks involved theft of credentials, sessions and TOTP seeds, consider rotating those secrets if you find suspicious activity. This is a precaution based on the earlier campaign, not a confirmed effect of this flaw.
6. Tell your incident response team and, if the device is exposed to the internet, consider restricting access until it is patched.

Detection and hunting ideas

No indicators of compromise have been published in the sources. Defenders can still hunt for requests to the Work Place interface from the same few external addresses repeated many times, and for the appliance making requests to internal hosts it does not normally contact. Monitor SonicWall’s advisory for an update confirming exploitation.

Related free tool: planning network segmentation or access rules for exposed devices? Our Subnet Calculator shows network ranges, masks and usable hosts for any CIDR block.

Sources

• SonicWall PSIRT advisory SNWLID-2026-0017
• NVD: CVE-2026-102255
• The Hacker News: Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
• SecurityWeek: Critical SonicWall Vulnerability Exploited Days After Disclosure