Attackers are targeting a critical vulnerability in SonicWall Secure Mobile Access (SMA) 1000 appliances, just days after the company released security updates to address the flaw.
Tracked as CVE-2026-102255, the vulnerability carries the maximum CVSS severity score of 10.0 and allows unauthenticated remote attackers to exploit a server-side request forgery (SSRF) weakness in the appliance’s WorkPlace interface. Successful exploitation could allow attackers to access internal services and perform unauthorized operations.
SonicWall released patches on October 6, 2026, but security researchers subsequently identified exploitation attempts targeting the vulnerability..
How CVE-2026-102255 Works
CVE-2026-102255 is a pre-authentication SSRF vulnerability affecting the WorkPlace interface of SonicWall SMA1000 appliances. According to SonicWall’s security advisory SNWLID-2026-0017, the flaw originates from an unintended alternate access path that allows attackers to manipulate how the appliance handles incoming requests.
SSRF vulnerabilities occur when attackers trick a server into sending requests to destinations of their choosing. In this case, an attacker could potentially use the SMA1000 appliance as an intermediary to reach internal services and functionality that would otherwise be inaccessible from the internet.
The vulnerability is particularly dangerous because exploitation does not require authentication or user interaction. An attacker only needs network access to the vulnerable interface to attempt exploitation.
Researchers Identify Active Exploitation Attempts
On October 9, security researchers identified exploitation attempts consistent with CVE-2026-102255.
According to BleepingComputer’s reporting, attackers targeted the WorkPlace Extraweb interface using specially crafted HTTP OPTIONS requests.
The requests attempted to reach an internal Apache CouchDB service running at 127.0.0.1:5984, a loopback address that normally cannot be accessed directly from external networks.
Researchers observed payloads designed to navigate into a CouchDB design document and invoke its _rewrite functionality. The requests also included an HTTP Basic Authentication header containing the credentials admin:admin.
This behavior suggests attackers were attempting to use the SSRF vulnerability to interact with privileged internal functionality through the exposed WorkPlace interface.
An October 9 update from the Canadian Centre for Cyber Security also confirms exploitation in the wild.
Affected Appliances and Available Security Updates
The vulnerability affects the following SonicWall SMA1000 appliances:
- SMA 6210
- SMA 7210
- SMA 8200v, including supported hypervisor deployments
The affected firmware versions are:
| Firmware branch | Vulnerable versions | Fixed version |
| 12.4.3 | 12.4.3-03526 and earlier | 12.4.3-03670 or later |
| 12.5.0 | 12.5.0-02952 and earlier | 12.5.0-03082 or later |
SonicWall confirmed that the issue does not affect the SMA 100 Series product line or the SSL-VPN functionality running on SonicWall firewalls.
The October security update also addresses three additional vulnerabilities: CVE-2026-102256, a remote code execution flaw rated 7.8; CVE-2026-102257, a Zip Slip path traversal vulnerability rated 7.2; and CVE-2026-102258, a stored cross-site scripting vulnerability rated 5.5.
Organizations should therefore prioritize installing the latest available firmware rather than applying fixes for individual vulnerabilities.
Recommended Mitigation and Detection Measures
Organizations using SonicWall SMA1000 appliances should treat CVE-2026-102255 as a high-priority remediation issue, particularly where the WorkPlace interface is exposed to the internet.
Security teams should consider the following actions:
1. Apply the latest SonicWall security updates. Identify all deployed SMA1000 appliances and verify their firmware versions. Upgrade affected systems to version 12.4.3-03670, 12.5.0-03082 or a newer supported release. Devices patched against the September vulnerabilities may still be vulnerable to CVE-2026-102255.
2. Investigate suspicious HTTP requests. Review available appliance, reverse-proxy and web security logs for unusual requests targeting the WorkPlace Extraweb interface. Potential indicators include crafted OPTIONS requests, references to the internal CouchDB service on port 5984, attempts to access CouchDB design documents or _rewrite functionality, and suspicious Basic Authentication headers. These patterns are investigative leads rather than confirmed indicators of successful compromise.
3. Review appliance activity for signs of compromise. Examine administrative access, configuration changes, authentication events and unexpected access to internal services. Correlate suspicious requests with subsequent activity to determine whether an attacker may have accessed privileged functionality.
4. Restrict unnecessary external access. Where operationally feasible, limit exposure of administrative interfaces and unnecessary services. Apply network segmentation and access restrictions to reduce the potential impact of a compromised remote access gateway.
5. Investigate suspected compromises before returning devices to normal operation. Preserve relevant logs and system evidence, and contact SonicWall support for assistance when suspicious activity is identified. If compromise is confirmed, assess whether appliance rebuilding, credential rotation or additional incident response measures are necessary.
Stay Safe. Stay Secure.
OP Innovate Research Team
