Exploitation attempts against SonicWall SMA1000 remote-access appliances started within days of a fix for a maximum-severity flaw. On Tuesday, October 6, 2026, SonicWall released hotfixes for CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) bug in the appliances' Appliance Work Place interface. With that release, the company said: "There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild." By October 9, two security firms told BleepingComputer they were seeing traffic consistent with the flaw in their honeypots and decoys.
The flaw affects the SMA1000 6210, 7210 and 8200v models. According to BleepingComputer, it does not affect the SMA 100 Series or the SSL-VPN feature on SonicWall firewalls.
What the flaw allows
NVD published its record for CVE-2026-102255 on October 7, and the record is still marked "Awaiting Analysis." It describes the bug this way: "A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path." Through that path, a remote, unauthenticated attacker "could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
The SonicWall data in the record lists two affected branches: "12.4.3-03526 (platform-hotfix) and older versions" and "12.5.0-02952 (platform-hotfix) and older versions." Weaknesses are classed as CWE-918 (server-side request forgery) and CWE-441 (unintended proxy or intermediary).
The record lists a CVSS 3.1 base score of 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. This score was added as secondary data by CISA's authorized data publisher program, not by SonicWall's own CNA entry. The vector means the flaw can be reached over the network with low attack complexity, needs no privileges and no user interaction, and has changed scope. Confidentiality, integrity and availability impact are all rated high. CISA's SSVC assessment on the same record, dated October 7, rated exploitation "none," technical impact "total" and automatable "yes."
From "no evidence" to honeypot hits
SonicWall published the fix in advisory SNWLID-2026-0017 and told customers to upgrade to the fixed release. BleepingComputer's October 7 report on the advisory describes no workaround. At the time, Shadowserver was tracking more than 400 internet-exposed SMA1000 appliances. BleepingComputer noted that some of those may already be patched, and its later report added that nobody knows how many are honeypots. So the figure measures exposure, not how many appliances are vulnerable.
On Friday, October 9, Ryan Dewhurst, founder of Previdian, told BleepingComputer that his company's honeypot network had picked up exploitation attempts consistent with CVE-2026-102255. He said crafted requests went after the Work Place Extraweb interface and attempted to reach an internal CouchDB service. Dewhurst added that Previdian had not yet established "whether those attempts would have successfully compromised any systems."
Threat intelligence firm Defused confirmed the activity. It said its SonicWall SMA decoys had been receiving unauthenticated SSRF traffic since October 8.
Both reports come from honeypots and decoys, which are systems set up to attract hostile traffic. They show the flaw is being targeted. They do not show that any production appliance has been compromised, and neither firm reported a confirmed breach.
A recurring target
According to BleepingComputer, attackers exploited two zero-days in SMA1000 appliances, CVE-2026-15409 and CVE-2026-15410, for weeks in July 2026. They used them to install custom malware named Sou5, OrangeTail and RootRun. CISA later linked some of those attacks to ransomware gangs. In September, SonicWall warned that attackers were chaining two more zero-days, CVE-2026-83548 and CVE-2026-83549, to run code remotely on SMA1000 gateways.
BleepingComputer also reported that CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog over the past four years and has flagged 13 of them as used in ransomware attacks.
KEV status
CVE-2026-102255 does not appear in CISA's KEV catalog as of the catalog's October 16 release, and the NVD record has no KEV date. Federal civilian agencies therefore have no binding remediation deadline for it yet. If CISA adds the flaw, a due date will follow under Binding Operational Directive 26-04.
What is not yet known
- Whether any attempt against a production appliance has succeeded.
- Who is behind the traffic. No source has attributed it to a named actor.
- Whether the October activity is connected to the attackers who exploited the July zero-days.
What It Means for Defenders
- Patch every SMA1000 appliance now. Compare each appliance's build with the affected branches above and with SNWLID-2026-0017. Don't assume an update was applied.
- Limit exposure until the patch is in. Restrict internet access to the Work Place interface by source IP or put it behind another access layer. Until then, treat the appliance as at risk.
- Hunt in logs from October 6 onward. Look for unauthenticated requests to the Work Place and Extraweb paths. Also look for the appliance making unexpected connections to internal services, including CouchDB.
- Assume compromise if you find signs of it. Rotate the credentials, session secrets and certificates held on the appliance or passing through it. Then check the downstream systems it can reach.
