Key points
- CVE-2026-102255 is a pre-authenticated SSRF affecting SMA1000 6210, 7210, and 8200v models.
- Threat intel firms detected exploitation attempts against honeypots two days after disclosure.
- The flaw allows unauthenticated attackers to force appliances to request internal services.
Security researchers have detected active exploitation attempts targeting a maximum-severity server-side request forgery flaw in SonicWall SMA1000 appliances. Tracked as CVE-2026-102255, the vulnerability was publicly disclosed on October 6, with patches released for affected models shortly thereafter.
Threat intelligence firm Defused reported observing unauthenticated SSRF traffic against its SonicWall SMA decoys starting October 8, only two days after the public disclosure. Previdian also confirmed these exploitation attempts, noting that the activity aligns with the specific mechanics of CVE-2026-102255.
Attack Mechanics and Impact
The flaw resides in the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. According to SonicWall, an unintended alternate access path allows a remote, unauthenticated attacker to direct the appliance to issue requests on their behalf. This capability enables attackers to reach internal functionality and perform unauthorized operations.
Previdian founder Ryan Dewhurst explained that attackers use a crafted OPTIONS request to target the WorkPlace Extraweb interface. This request aims to reach the appliance’s internal CouchDB service at 127.0.0.1:5984. The payload attempts to traverse into a CouchDB design document and invoke its _rewrite function, supplying default admin credentials in the process.
Scope and Exposure
The vulnerability does not affect the SMA 100 Series product line or SSL-VPN services running on SonicWall firewalls. It specifically impacts the listed SMA1000 gateway models. Horizon3.ai warned that successful exploitation could allow attackers to take over vulnerable devices entirely.
Shadowserver currently tracks more than 400 SMA1000 appliances exposed online. However, there is no confirmed data on how many of these exposed devices are honeypots or have already applied the necessary security updates. SMA1000 gateways are frequently targeted because managed service providers and large organisations use them for VPN access to internal networks.
What happens next
Organisations using affected SMA1000 models should verify their current software versions immediately. SonicWall urged customers to update 6210, 7210, and 8200v models to software versions 12.5.0-03082 and 12.4.3-03670. While exploitation attempts are confirmed, Previdian has not yet established whether these attempts have successfully compromised any real-world systems.
What to do and how to stay safe: SonicWall
- Audit your SMA1000 appliance models to check if you run versions 6210, 7210, or 8200v.
- Verify that your devices are updated to software versions 12.5.0-03082 or 12.4.3-03670.
- Monitor network logs for unusual OPTIONS requests targeting the WorkPlace Extraweb interface.
- Restrict external access to management interfaces where possible to reduce exposure.
Step-by-step guide: Patch Management Policy: How to Automate Fixes Without Breaking Systems
General security guidance from the Payload Report newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-102255 being exploited in the wild?
Yes, threat intelligence firms have detected exploitation attempts against decoys and honeypots days after disclosure.
Which SonicWall appliances are affected by this SSRF flaw?
The flaw affects SMA1000 6210, 7210, and 8200v models, but not the SMA 100 Series or SSL-VPN on firewalls.
How can attackers exploit this vulnerability?
Attackers use crafted OPTIONS requests to force the appliance to access internal services like CouchDB.
