Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

SonicWall SMA 1000 Pre-Auth SSRF Flaw Exploited Days After Patch

SonicWall customers are once again in a familiar but unenviable position: a maximum-severity, CVSS 10.0 vulnerability in the SMA 1000 series of Secure Mobile Access appliances is being actively exploited in the wild, just days after the vendor shipped a fix. The flaw, tracked as CVE-2026-102255, is a pre-authenticated server-side request forgery (SSRF) bug in the appliance's WorkPlace interface — the web portal remote users connect through — that lets a remote, unauthenticated attacker force the device to issue requests on its own behalf and reach internal functionality that should never be exposed externally.

SonicWall published its advisory on October 6, 2026, and initially stated there was "currently no evidence" of in-the-wild exploitation. That assessment did not hold for long: threat-intelligence firms Previdian and Defused detected live exploitation attempts against honeypot and decoy SMA devices beginning October 8–9, 2026 — just two to three days after disclosure.

Incident Details

How It Works

An Unintended Alternate Access Path

According to SonicWall's advisory, CVE-2026-102255 exists because of an "unintended alternate access path" into the SMA1000 WorkPlace interface. Because the flaw requires no authentication, any attacker with network access to the appliance can abuse this path to direct the device to "issue requests on their behalf and reach internal functionality and perform unauthorized operations," in the vendor's own words — the textbook definition of SSRF.

The Observed Exploitation Technique

Security researchers tracking the attacks identified the specific technique in use: attackers send crafted OPTIONS requests to the WorkPlace interface that are redirected internally to the appliance's local CouchDB service, listening on 127.0.0.1:5984, using default admin:admin credentials. Because CouchDB is only meant to be reachable from inside the appliance itself, the SSRF flaw effectively hands an unauthenticated internet-facing attacker a path straight to an internal, pre-authenticated administrative data store.

Scale of the Exploitation Attempts

Threat-intelligence firm Previdian recorded a total of 135 exploitation attempts from two unique IP addresses located in the United States as of its latest count. Defused independently confirmed unauthenticated SSRF traffic hitting its SonicWall SMA decoy devices starting October 8. Internet-exposure tracker Shadowserver counted more than 400 internet-accessible SMA1000 devices, though some portion of that number may already be patched.

Part of a Recurring Pattern

This is not an isolated incident for SonicWall's remote-access line. In June 2026, two other SMA1000 zero-days — CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) — were weaponized by a threat actor tracked as UTA0533, who deployed Java web shells and malware dubbed KNUCKLEBALL to extract credentials, session databases, and TOTP MFA seed configurations for lateral movement. More broadly, CISA has catalogued 19 SonicWall vulnerabilities exploited in the wild over the past four years, with 13 of them linked to ransomware operations — a track record that makes any new critical, pre-auth SMA1000 flaw an immediate priority.

Impact Assessment

Recommendations

For Administrators

• Apply the hotfix immediately. Upgrade to 12.4.3-03670 or 12.5.0-03082 (or later) via MySonicWall — there is no workaround for CVE-2026-102255.
• Verify the running firmware version on every SMA1000 appliance (6210, 7210, 8200v, physical or virtual) rather than assuming a prior update already covers this advisory.
• Treat any internet-facing SMA1000 appliance that was unpatched between October 6 and the time you applied the hotfix as potentially exploited, not merely vulnerable.

For Security Teams

• Hunt for anomalous OPTIONS requests against the WorkPlace interface in appliance and perimeter logs, particularly traffic consistent with internal redirection toward 127.0.0.1:5984.
• Rotate credentials and session data on any appliance that was exposed, given the precedent of credential and TOTP MFA seed theft in the June 2026 SMA1000 campaign.
• Check for web shells and unexpected persistence mechanisms (cron entries, disguised services) on any device suspected of compromise, mirroring TTPs previously documented for UTA0533.
• Monitor Shadowserver and other exposure-tracking feeds for your organization's SMA1000 devices to confirm they have dropped off the internet-facing vulnerable list.

For IT Leadership

• Inventory all SMA 1000 appliances (physical and virtual) across the organization, including ones managed by third parties or MSSPs, and confirm patch status for each.
• Reassess why the WorkPlace interface is directly internet-facing where possible, and whether access can be restricted to known IP ranges or brokered through additional authentication layers.
• Given CISA's four-year record of 19 exploited SonicWall flaws, with 13 tied to ransomware, consider accelerated patch SLAs specifically for SonicWall remote-access gateways rather than standard change-management timelines.

Key Takeaways

1. CVE-2026-102255 is a maximum-severity, CVSS 10.0, pre-authenticated SSRF flaw in the SonicWall SMA1000 WorkPlace interface, requiring no credentials to exploit.
2. Active exploitation began within two to three days of disclosure — despite SonicWall initially stating there was no evidence of in-the-wild attacks.
3. The observed attack technique uses crafted OPTIONS requests to reach the appliance's internal CouchDB service via default admin:admin credentials.
4. Three companion CVEs (command injection, path traversal, XSS) were patched in the same October 6 advisory and raise the risk of full-chain compromise.
5. This fits a documented pattern: June 2026 SMA1000 zero-days were weaponized by UTA0533 for web shells and credential/MFA-seed theft, and CISA has tracked 19 exploited SonicWall flaws — 13 ransomware-linked — over four years.
6. No workaround exists. Patching to 12.4.3-03670 or 12.5.0-03082 is the only remediation, and over 400 SMA1000 devices remain internet-exposed.

Sources

• DarkReading — Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
• The Hacker News — Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
• BleepingComputer — SonicWall warns of max severity SSRF flaw in SMA1000 gateways
• Help Net Security — SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255)
• SecurityWeek — Critical SonicWall Vulnerability Exploited Days After Disclosure