Attackers Probed a CVSS 10 SonicWall SMA1000 Flaw Two Days After Its Patch, the Third Such Fix in 12 Weeks

Two threat-intelligence firms say they have seen attempts to exploit CVE-2026-102255, a maximum-severity flaw in SonicWall’s SMA1000 remote-access appliances, within two to three days of the vendor’s October 6 patch. Defused says its decoy appliances received the first traffic on October 8, and Previdian posted a sensor log on October 9. Neither says an attempt succeeded. When we checked on the morning of Monday, October 12, SonicWall’s advisory still carried only its October 6 release and its statement that the company had no evidence of exploitation, and the CISA Known Exploited Vulnerabilities (KEV) catalog did not list the flaw.

It is the third maximum-severity server-side request forgery (SSRF) bug in the SMA1000’s WorkPlace web interface that SonicWall has patched since July, and the build numbers tell administrators what matters: the builds that fixed the September flaws are now the newest ones SonicWall lists as vulnerable. SecurityWeek reported the exploitation attempts on Monday, following BleepingComputer’s report on Friday.

What SonicWall disclosed on October 6

Advisory SNWLID-2026-0017 covers four vulnerabilities in the SMA1000 6210, 7210 and 8200v models. SonicWall says there is no workaround, and that the SMA 100 Series and SSL-VPN running on SonicWall firewalls are not affected. Help Net Security describes the SMA1000 line as SSL VPN gateways used by medium to large enterprises, managed security service providers and government agencies. The four flaws are:

• CVE-2026-102255, CVSS 10.0: a pre-authentication SSRF in the WorkPlace interface. SonicWall’s heading calls it “Pre-authentication SSRF via unintended forward-proxy” and says an “unintended alternate access path” lets a remote unauthenticated attacker “direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
• CVE-2026-102256, CVSS 7.8: a post-authentication OS command injection that, in specific conditions, lets an authenticated administrator run arbitrary commands.
• CVE-2026-102257, CVSS 7.2: a post-authentication Zip Slip flaw in the Appliance Management Console (AMC) that SonicWall says can lead to remote code execution.
• CVE-2026-102258, CVSS 5.5 in the advisory: a post-authentication stored cross-site scripting flaw in the AMC. The NVD record for it lists 6.1 with a different vector.

The advisory credits Benoît Sevens of Anthropic for CVE-2026-102255 and CVE-2026-102256, and Brian Mariani for the other two: CVE-2026-102257 through Trend Micro’s Zero Day Initiative (ZDI-CAN-28924) and CVE-2026-102258 through DigitalCanion SA. It does not say how Sevens found the bugs, and we did not find an Anthropic statement about them. The July and September advisories credited SonicWall’s own staff.

What the researchers saw

Previdian, formerly KEVIntel, wrote on X on Friday, October 9, that “SonicWall SMA1000 exploitation attempts are now being observed by Previdian sensors, consistent with CVE-2026-102255 (CVSS 10.0).” Its post lists one attacker IP address, 146.70.143[.]142, and tells readers to “Apply SonicWall’s hotfix and investigate matching traffic.”

Previdian founder Ryan Dewhurst told BleepingComputer that the requests “targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance’s internal CouchDB service at 127.0.0.1:5984.” The payload, he said, tried to reach a CouchDB design document and call its _rewrite function while sending an HTTP Basic Authorization header with the credentials admin:admin. He added that Previdian has not established “whether those attempts would have successfully compromised any systems.”

The screenshot in Previdian’s post is a request log from one of its sensors. It shows an OPTIONS request whose request line holds a complete URL for 127.0.0.1 on port 5984 instead of an ordinary path, which fits SonicWall’s “unintended forward-proxy” label. That reading of the image is ours, not Previdian’s.

Defused, which runs decoy appliances, wrote the same day that “Since yesterday we have been observing unauthenticated SSRF traffic against our SonicWall SMA decoys.” SecurityWeek reports that the first attempts reached the decoys on October 8, two days after SonicWall’s advisory. The Defused post includes a card describing “unauthenticated loopback SSRF traffic.” The card is tagged with both CVE-2026-102255 and July’s CVE-2026-15409, and Defused says its capture, including what differs from known tooling, is available to subscribers.

Horizon3.ai said on October 8 that its attack team was investigating CVE-2026-102255, “a pre-authentication SSRF in SonicWall SMA1000 Series appliances that could result in takeover of the device.” SonicWall’s own advisory says only that the flaw can reach “internal functionality.”

Several things are missing from these sources: a confirmed compromise, a named victim, or an actor behind the traffic. The sources we read also do not link a public proof of concept or technical write-up. SonicWall’s advisory says “There is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild.” That described the moment it published on October 6, and the advisory’s revision history still lists only that initial release.

Three advisories in twelve weeks

SonicWall’s PSIRT pages load their content with JavaScript, so a plain fetch returns no advisory text, but the JSON API behind them returns each advisory in full. Reading the three SMA1000 advisories since July side by side shows a pattern.

Three things stand out.

First, each advisory leads with a pre-authentication SSRF in the WorkPlace interface and pairs it with post-authentication code execution that needs administrator access. SonicWall gave the September and October SSRFs the same heading, “Pre-authentication SSRF via unintended forward-proxy,” the same phrase “due to an unintended alternate access path,” and the same pair of weakness classes: CWE-918 (SSRF) and CWE-441, which MITRE titles “Unintended Proxy or Intermediary” and which is also known as the confused deputy problem. Dewhurst told BleepingComputer the October bug affects the same interface as the July and September ones but “uses a different exploitation technique.” SonicWall has not said any of the three is a regression or an incomplete fix of another, and this post does not claim that.

Second, the fix for each round is the ceiling of the next. SonicWall’s September advisory lists 12.4.3-03453 and 12.5.0-02835, the July fix builds, as affected. The October advisory lists 12.4.3-03526 and 12.5.0-02952, the September fix builds, as affected. An appliance that stopped at the September fix is still in the affected range. Field Effect made the same point, saying organizations that patched for the September flaws “may still be running versions affected by CVE-2026-102255.”

Third, CISA moved fast on the earlier pairs. It added CVE-2026-15409 and CVE-2026-15410 to KEV on July 14, the day of SonicWall’s advisory, and CVE-2026-83548 and CVE-2026-83549 on September 2, the day after. Both earlier advisories came with SonicWall’s own statement that it had investigated exploitation; this one did not. In July, Volexity said an actor it tracks as UTA0533 had chained the two bugs for weeks before a patch existed, as we reported. Counting from the KEV feed, the catalog holds six SMA1000 entries (the others are CVE-2025-23006, added in January 2025, and CVE-2025-40602, added in December 2025) and 19 SonicWall entries in all, 13 of them marked as used in ransomware campaigns, which matches BleepingComputer’s tally. CVE-2026-102255 is not among them. The newest release of the feed when we checked was dated October 8, so a listing could still come.

Which builds to install, and one alert that lists older ones

SonicWall’s fixed builds are 12.4.3-03670 and 12.5.0-03082 and later, and the advisory says there is no workaround. Check the full platform-hotfix string on every 6210, 7210 and 8200v rather than only the 12.4.3 or 12.5.0 train.

One government alert lists older numbers. The Cyber Security Agency of Singapore published AL-2026-137 on October 8. It names SonicWall’s affected builds correctly, then recommends updating to “12.4.3-03453 or 12.5.0-02835, or later releases.” Those are the July fix builds, which SonicWall’s September advisory lists as affected. The page still read that way when we fetched it on October 12, so take the build numbers from SonicWall’s advisory.

What defenders can check now

• Version. Confirm the platform-hotfix on each appliance against the fixed builds above.
• Logs. Where your proxy, WAF or appliance logs record request lines, search retained logs for requests to the WorkPlace interface whose request line is a complete URL, for OPTIONS requests that mention 127.0.0.1, port 5984, _design or _rewrite, and for Previdian’s listed address, 146.70.143[.]142. One IP address is a weak indicator, and SonicWall’s advisory lists no indicators of compromise.
• Reach. Because the bug makes the appliance send requests on an attacker’s behalf, review which internal services it can reach and restrict outbound connections to what remote access needs, as Field Effect advises.
• If something matches, treat it as an incident and involve SonicWall support. The advisory gives no compromise-check guidance for this flaw.

What is still unknown

SonicWall has not said which internal functionality the SSRF reaches, so the CouchDB service in Previdian’s log is the only concrete target in public view. Whether any attempt succeeded, which appliances were hit, and who is behind the traffic are all open. BleepingComputer cites Shadowserver for more than 400 SMA1000 appliances exposed to the internet but notes there is no information on how many are honeypots or already patched. NVD has not analyzed the CVE yet, and its 10.0 score is the one SonicWall supplied. Watch for a revision to SNWLID-2026-0017, a KEV entry (which would carry a due date for U.S. federal agencies), and the follow-up Horizon3.ai promised.

Sources and method

We read SonicWall advisories SNWLID-2026-0008, SNWLID-2026-0016 and SNWLID-2026-0017 through the JSON API behind its PSIRT pages, the NVD records for the four October CVEs, CISA’s KEV feed (release dated October 8), the X posts from Previdian, Defused and Horizon3.ai, and reporting from BleepingComputer, SecurityWeek, Help Net Security, Field Effect and the Cyber Security Agency of Singapore. We counted KEV entries from the feed instead of relying on an outlet’s tally. The checks of SonicWall’s advisory, the KEV feed and the Singapore alert were made on the morning of October 12 (UTC). Our reading of the Previdian screenshot is an interpretation, and we have not tested anything against a SonicWall appliance.