SonicWall CVE-2026-102255 SMA1000 SSRF probed
Pre-auth WorkPlace SSRF, CVSS 10.0, 135 attempts

SonicWall CVE-2026-102255 SMA1000 SSRF probed

A maximum-severity flaw in SonicWall SMA1000 remote-access appliances is already being probed. The bug is a pre-authentication server-side request forgery in the WorkPlace interface. An attacker who never logs in can make the appliance request internal services on their behalf.

What happened

SonicWall published SNWLID-2026-0017 for four issues. The critical one is CVE-2026-102255, scored 10.0. The same notice also covers CVE-2026-102256 (RCE, 7.8), CVE-2026-102257 (Zip Slip, 7.2), and CVE-2026-102258 (stored XSS, 5.5). Fixed platform-hotfix builds are 12.4.3-03670 and 12.5.0-03082.

SonicWall's notice still says it has no evidence of exploitation. Independent researchers disagree on the traffic. Previdian and Defused reported attempts from 8 October. By 12 October, The Hacker News and eSecurity Planet cited 135 attempts from two US addresses. Previdian described crafted OPTIONS requests aimed at an internal CouchDB listener on 127.0.0.1 port 5984. Researchers have not confirmed a successful compromise. This is a different WorkPlace path from the July and September SMA1000 flaws.

Who is affected

  • SMA1000 models 6210, 7210, and 8200v, physical and virtual
  • Platform-hotfix 12.4.3-03526 and older, and 12.5.0-02952 and older
  • SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected

What to do now

Install platform-hotfix 12.4.3-03670 or 12.5.0-03082, or a later build, on every SMA1000 that faces clients or the internet. If the management interface was exposed before the hotfix, review admin sessions and VPN accounts for unexpected access. Do not treat SonicWall's "no evidence" line as a reason to wait. Honeypot traffic is already matching the bug.

Source: SonicWall SNWLID-2026-0017.

Also on the blog

Next step: If this is on your network or a client's, ask Matthews Enterprises to check exposure.

Frontier AI cleared every OT attack goal in a Booz Allen lab
Frontier AI operational technology attack lab results