Critical SSRF Flaw in SonicWall SMA1000 Actively Exploited
Attackers are actively exploiting a maximum-severity vulnerability in SonicWall SMA1000 secure remote access appliances, tracked as CVE-2026-102255. The flaw was patched by SonicWall on Tuesday, October 8, 2026, just three days prior to public disclosure of active exploitation attempts. The vulnerability resides in the Appliance WorkPlace interface and affects SMA1000 models 6210, 7210, and 8200v, while the SMA 100 Series and SSL-VPN implementations on SonicWall firewalls remain unaffected.
Technical Details of CVE-2026-102255 Exploitation
According to SonicWall’s advisory, the vulnerability allows a remote, unauthenticated attacker to manipulate the appliance into issuing arbitrary requests on their behalf. This could lead to unauthorized access to internal functionality and the execution of operations without proper authentication. Security researcher Ryan Dewhurst, founder of Previdian, confirmed to BleepingComputer that his organization’s honeypot network detected exploitation attempts consistent with CVE-2026-102255 on Friday, October 11, 2026.
The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin.
Dewhurst noted that while the activity matches the exploitation pattern of CVE-2026-102255, Previdian has not yet confirmed whether any of these attempts resulted in successful system compromise. He also emphasized that this vulnerability targets the same WorkPlace interface previously affected by SSRF flaws disclosed in July and September 2026 (CVE-2026-15409 and CVE-2026-15410), but employs a distinct exploitation technique.
Widespread Exposure and Historical Context of SMA1000 Attacks
Shadowserver data shows that over 400 SonicWall SMA1000 appliances are currently exposed to the internet, though it is unclear how many of these are honeypots, unpatched systems, or legitimate deployments. These enterprise-grade gateways are frequently targeted due to their widespread use by Managed Service Providers (MSSPs), large corporations, and government agencies for secure VPN access to internal applications and networks.
The SMA1000 has been a repeated target in 2026. In July, attackers chained two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to deploy custom malware families — Sou5, OrangeTail, and RootRun — on vulnerable appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) later attributed some of these intrusions to ransomware gangs. In September, SonicWall warned of another pair of actively exploited zero-days (CVE-2026-83548 and CVE-2026-83549) being used in the wild to achieve remote code execution on SMA1000 gateways.
CISA’s Ongoing Tracking of SonicWall Vulnerabilities
Over the past four years, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities (KEV) catalog. Of these, 13 have been flagged as being actively used by ransomware groups in real-world attacks. The inclusion of CVE-2026-102255 in active exploitation attempts, even before formal KEV designation, underscores the persistent threat landscape facing SSL VPN and remote access appliances.
Organizations using SonicWall SMA1000 devices are strongly advised to apply the latest security patches immediately and restrict exposure of management interfaces to trusted networks only. Monitoring for anomalous OPTIONS requests or internal service probing — particularly to localhost ports like 5984 (CouchDB) — is recommended to detect ongoing exploitation attempts.
Source: BleepingComputer