Key points
- CVE-2026-102255 allows unauthenticated attackers to perform server-side request forgery on SMA1000 appliances.
- Previdian and Defused confirmed exploitation attempts against honeypots shortly after the October 6 disclosure.
- The flaw affects 6210, 7210, and 8200v models but does not impact the SMA 100 Series or standard SSL-VPN gateways.
SonicWall SMA1000 administrators should update their appliances, as threat intelligence firms have detected exploitation attempts for a critical server-side request forgery vulnerability tracked as CVE-2026-102255. The flaw, which carries a maximum CVSS score of 10.0, was patched on Tuesday, but probing activity began within days of the public disclosure.
Security researchers from Previdian and Defused reported detecting traffic consistent with exploitation attempts against their honeypots. These requests target the Appliance WorkPlace interface, using crafted requests to reach internal services. The rapid onset of this activity underscores the need for organizations relying on these remote access gateways to verify their patch status.
What we know
The vulnerability affects specific SonicWall SMA1000 models, including the 6210, 7210, and 8200v. According to SonicWall, the defect allows a remote, unauthenticated attacker to potentially direct the appliance to issue requests on their behalf. This capability could enable access to internal functionality and the execution of unauthorized operations within the network.
Previdian founder Ryan Dewhurst detailed the observed activity to BleepingComputer. The requests target the WorkPlace Extraweb interface with a crafted OPTIONS request. This targets the internal CouchDB service at 127.0.0.1:5984, attempting to traverse into a design document and invoke its _rewrite function. The payload includes HTTP Basic Authorization headers with default admin credentials.
Defused confirmed observing unauthenticated SSRF traffic against its SonicWall decoys starting on October 8. This was only two days after SonicWall disclosed the flaw on October 6. The firm urged customers to update to software versions 12.5.0-03082 or 12.4.3-03670. While this activity is consistent with active exploitation attempts, Previdian noted it has not established whether any systems were successfully compromised.
The SMA1000 line is often targeted because managed service providers, large corporations, and government agencies use these enterprise-grade secure remote access gateways. They provide VPN access to internal applications and corporate networks, making them high-value targets for attackers seeking initial footholds.
Shadowserver currently tracks more than 400 SMA1000 appliances exposed online. However, there is no data on how many of these devices are honeypots or have already been patched against CVE-2026-102255. The flaw does not affect the SMA 100 Series product line or SSL-VPN running on other SonicWall firewalls.
Defender's checklist
- Verify if your environment includes SonicWall SMA1000 models 6210, 7210, or 8200v.
- Check current firmware versions against the required 12.5.0-03082 or 12.4.3-03670 updates.
- Review firewall logs for unusual OPTIONS requests targeting the WorkPlace interface.
- Monitor for traffic destined to internal CouchDB ports from external sources.
Background: Threat intelligence program
A threat intelligence program converts external data into internal action. You need a defined scope, automated ingestion pipelines, and a feedback loop with defenders. Without these, you collect noise. Use this checklist to audit your current capabilities and close the gaps between collection and response.
Read the full guide: Threat Intelligence Program Checklist for Secure Operations
What to do and how to stay safe: SonicWall
- Audit all remote access appliances to ensure they are not running vulnerable software versions.
- Apply the vendor-released patch immediately to close the SSRF vector.
- Restrict network access to the WorkPlace interface using strict firewall rules.
- Monitor for anomalous internal traffic patterns that indicate server-side request forgery.
Step-by-step guide: Security Advisories: Small Business Patching Strategy
General security guidance from the Malware Chronicle newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Does this vulnerability affect all SonicWall products?
No, the flaw only affects SMA1000 models 6210, 7210, and 8200v. It does not impact the SMA 100 Series or SSL-VPN on other firewalls.
What is the severity of CVE-2026-102255?
The vulnerability has a maximum CVSS score of 10.0, indicating a critical risk that allows unauthenticated remote exploitation.
Has the vendor released a fix?
Yes, SonicWall released patches on Tuesday, advising updates to versions 12.5.0-03082 and 12.4.3-03670.
