Attackers have started probing a maximum-severity vulnerability in SonicWall’s SMA1000 remote access appliances just days after the company released fixes, according to honeypot data from security firm Previdian reported by BleepingComputer on October 9.
The vulnerability
The flaw, tracked as CVE-2026-102255, has a CVSS score of 10, the highest possible, according to SecurityWeek. It affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models. SonicWall says it does not affect the SMA 100 series or the SSL-VPN feature on SonicWall firewalls.
The bug is a pre-authentication server-side request forgery (SSRF). In an SSRF attack, the attacker tricks a server into making web requests on the attacker’s behalf. Because those requests come from the appliance itself, they can reach internal services that are normally hidden from the internet. SonicWall said a remote, unauthenticated attacker could “direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”
SMA1000 appliances give employees remote access to corporate networks, which is why flaws in them are valuable to attackers: they sit at the edge of the network and are reachable from the internet by design.
From patch to probing in days
SonicWall released fixes on October 6, according to BleepingComputer, in versions 12.5.0-03082 and 12.4.3-03670, as reported by SecurityWeek. At the time, SonicWall said there was no evidence that the flaw was being exploited.
That changed within days. Ryan Dewhurst, founder of Previdian, told BleepingComputer that the company’s honeypot network (decoy systems that record attack traffic) detected exploitation attempts “consistent with” the flaw. The requests targeted the WorkPlace Extraweb interface and used a specially crafted OPTIONS request to reach an internal CouchDB database service at 127.0.0.1:5984, logging in with the default credentials admin:admin. Dewhurst said Previdian has not established “whether those attempts would have successfully compromised any systems.”
Previdian also tracked rapid exploitation attempts against the critical Atlassian Data Center flaw that began two hours after technical details were published.
The Shadowserver Foundation tracks more than 400 SMA1000 appliances exposed online, although it is not known how many are already patched. As of the sources reviewed for this article, it was not confirmed whether CISA had added CVE-2026-102255 to its Known Exploited Vulnerabilities catalog.
A repeat target
This is not the first time the WorkPlace interface has been targeted this year. In July, two SSRF flaws (CVE-2026-15409 and CVE-2026-15410) were exploited as zero-days to install custom malware, and CISA later linked some of those attacks to ransomware gangs. Last month, SonicWall warned that CVE-2026-83548 and CVE-2026-83549 were being chained together in attacks to execute code remotely. According to BleepingComputer, CISA has added 19 SonicWall vulnerabilities to its exploited list over four years, 13 of them linked to ransomware.
Security appliances at the network edge keep drawing attackers, as seen with the Check Point zero-day exploited to hijack security management servers last month.
What administrators should do
Organizations running SMA1000 appliances should update to 12.5.0-03082 or 12.4.3-03670 as soon as possible, limit internet exposure of the management and WorkPlace interfaces where they can, and review logs for unusual requests to the WorkPlace Extraweb interface.
Sources
- SonicWall PSIRT: SNWLID-2026-0017
- BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited in attacks (October 9, 2026)
- SecurityWeek: SonicWall and Splunk Patch Critical Vulnerabilities (October 8, 2026)
