If your employees, contractors, or managed service provider reach internal systems through a SonicWall SMA1000 remote access gateway, that gateway has a new maximum-severity flaw, and attackers began testing it within three days of the fix being released. Someone with no username or password can send the gateway a crafted request and make it act on their behalf, reaching functions that are only meant to be used by the appliance itself. This is the third flaw of this kind in the same product this year; the first two were used to plant malware on remote access gateways and were later tied to ransomware operations. The detail that matters most: a gateway that was fully patched in September is still exposed, because the version SonicWall shipped to stop September's attacks is one of the versions affected now. The fix is available, it needs one maintenance window and a restart, and there is no workaround.
The flaw is tracked as CVE-2026-102255 and carries a CVSS score of 10.0 out of 10. It is a pre-authentication server-side request forgery (SSRF) bug in the WorkPlace portal of SMA1000 6210, 7210, and 8200v appliances, disclosed alongside three lower-severity flaws that require a login. SonicWall fixed all four in platform-hotfix 12.4.3-03670 and 12.5.0-03082. The sections below cover what the attack traffic looks like, how to confirm whether your appliances are exposed, and what to do in what order.
Why this one matters
Remote access gateways are the front door of the corporate network. They sit on the internet by design, they accept connections from anyone who can reach them, and once they let someone through, that person is inside. That makes them one of the most valuable targets an attacker can hit, and the SMA1000 has been hit repeatedly in 2026.
SMA1000 appliances are enterprise-grade gateways commonly used by large organisations, managed service providers, and government agencies to give remote users access to internal applications. An attacker who controls one sits at the junction between the internet and everything the gateway was built to protect, with a view of who is logging in and the ability to reach systems that are not exposed anywhere else.
CVE-2026-102255 requires no authentication and no user interaction. SonicWall says it lets a remote attacker direct the appliance to send requests on the attacker's behalf, reach internal functionality, and perform unauthorized operations. SonicWall has not said which internal functions can be reached or whether the flaw can be combined with the other three it fixed this week, but the two previous WorkPlace SSRF flaws this year were each used as the first step in a chain that ended with attackers running commands on the appliance.
How this came to light
SonicWall published advisory SNWLID-2026-0017 on October 6, 2026, covering four flaws. At the time, it said there was no evidence that any of them were being exploited. The pre-authentication SSRF and one of the authenticated flaws were reported by Benoît Sevens of Anthropic; the other two were reported by Brian Mariani of DigitalCanion SA, one of them through Trend Micro's Zero Day Initiative.
That picture changed quickly. On October 9, Ryan Dewhurst, founder of Previdian, told BleepingComputer that his company's honeypot network had recorded exploitation attempts consistent with CVE-2026-102255. Previdian has not established whether those attempts would have succeeded against a real appliance, and SonicWall had not updated its advisory to reflect exploitation at the time of writing. CVE-2026-102255 was also not in CISA's Known Exploited Vulnerabilities (KEV) catalog as of the most recent checks we could find. Neither of those facts should be read as reassurance: three days from patch to hostile traffic is a strong signal that someone has worked out where the flaw is.
Shadowserver currently tracks more than 400 SMA1000 appliances reachable from the internet. It is not known how many of those are honeypots or have already been patched.
How the flaw works
The SSRF (CVE-2026-102255)
Server-side request forgery is a flaw that lets an outsider make a server send requests for them. Normally a remote access gateway only talks to its own internal services on behalf of users who have already logged in. SonicWall attributes CVE-2026-102255 to an unintended alternate access path in WorkPlace, the portal that SMA1000 users log in to, which lets an unauthenticated request slip through that path and reach services that should only ever be talked to from inside the appliance.
The traffic Previdian observed gives a useful picture of what attackers are attempting. According to Dewhurst, the requests:
- targeted the WorkPlace Extraweb interface using crafted HTTP OPTIONS requests;
- aimed to reach the appliance's internal CouchDB database service at 127.0.0.1:5984, which is not meant to be reachable from outside;
- tried to traverse into a CouchDB design document and invoke its
_rewritefunction; - carried an HTTP Basic Authorization header with the credentials
admin:admin.
Dewhurst noted that this targets the same WorkPlace interface as the SSRF flaws disclosed in July and September, but uses a different exploitation technique. In other words, this is not a replay of an old exploit against unpatched boxes; it is a new route to the same place.
The other three flaws
All three require a valid login, which makes them less urgent on their own but more dangerous in combination with a pre-authentication foothold.
| CVE | Flaw | Where | Access needed | CVSS |
|---|---|---|---|---|
| CVE-2026-102255 | Server-side request forgery (SSRF) | WorkPlace | None | 10.0 |
| CVE-2026-102256 | OS command injection that could lead to remote code execution | Appliance (component not named) | Administrator login | 7.8 |
| CVE-2026-102257 | Zip Slip path traversal through a crafted archive, which could lead to remote code execution | Appliance Management Console (AMC) | Login | 7.2 |
| CVE-2026-102258 | Stored cross-site scripting (XSS) | Appliance Management Console (AMC) | Administrator login | 5.5 |
The shape of this release matches the two before it. In July and September, SonicWall disclosed a pre-authentication WorkPlace SSRF paired with a flaw that lets a logged-in administrator run commands, and in both cases attackers chained them. In July, Rapid7 described attackers using the SSRF to tunnel into internal-only services, running commands from there, and then using the second flaw to gain root, which is complete control of the appliance. SonicWall has not said whether CVE-2026-102255 can be chained with CVE-2026-102256 in the same way, but the pairing is familiar enough that it is safest to assume it can until shown otherwise.
Who is affected
| Product | Affected versions | Fixed versions |
|---|---|---|
| SMA1000 6210, 7210, 8200v on 12.4.3 | 12.4.3-03526 and older | 12.4.3-03670 and later |
| SMA1000 6210, 7210, 8200v on 12.5.0 | 12.5.0-02952 and older | 12.5.0-03082 and later |
| SMA 100 Series | Not affected | |
| SSL-VPN on SonicWall firewalls | Not affected |
Note the affected versions carefully. 12.4.3-03526 and 12.5.0-02952 are the hotfixes SonicWall released on September 1 to stop the actively exploited CVE-2026-83548 and CVE-2026-83549. If your team applied those promptly and marked the September incident closed, the appliance is still vulnerable to CVE-2026-102255 and needs the October hotfix.
What you should do
1. Confirm the exact version on every SMA1000
Find every SMA 6210, 7210, and 8200v in the environment, including virtual appliances and any run on your behalf by a managed service provider, and record the full platform-hotfix version shown in the Appliance Management Console. Do not rely on "we patched in September"; check the build number against the table above.
2. Apply the October hotfix now
Install 12.4.3-03670 or 12.5.0-03082 or later from the MySonicWall portal. The appliance restarts when installation completes, so schedule a short window, but do not let it slip to the next routine maintenance cycle. SonicWall lists no workaround, so the hotfix is the only fix.
3. Look for signs of exploitation before and after patching
Patching closes the door but does not tell you whether someone already came through it. Review WorkPlace web logs, and any reverse proxy, load balancer, or WAF logs in front of the appliance, going back to at least October 6, for:
- HTTP OPTIONS requests to WorkPlace or Extraweb paths, particularly from addresses that are not your users;
- request content referencing
127.0.0.1:5984,_design, or_rewrite; - Basic Authorization headers carrying
admin:admin; - any unexpected configuration changes, new administrator accounts, or unfamiliar files on the appliance.
SonicWall has not published indicators of compromise for this release, so treat anything unusual as worth investigating rather than waiting for an official list.
4. If you find anything, follow the July and September playbook
SonicWall has not issued post-compromise guidance for CVE-2026-102255, but for the two earlier WorkPlace SSRF incidents it told customers who found indicators of compromise to re-image or redeploy the appliance, change all user and administrator passwords, and reset the TOTP tokens used for one-time login codes. That is a sensible baseline here. Because the gateway sees every remote login, also review authentication activity on the internal systems it provides access to.
5. Reduce who can reach the management side
WorkPlace has to face the internet for remote users, but the Appliance Management Console does not. Confirm that AMC is reachable only from a dedicated management network, which limits the value of the three authenticated flaws if an attacker does obtain credentials or a foothold. Where your user base allows it, restricting WorkPlace by geography or source network also shrinks the pool of people who can try the SSRF.
6. Make sure the gateway is watched
Forward SMA1000 logs to a central collector the appliance cannot alter, and alert on administrator logins, configuration changes, and unusual WorkPlace request patterns. Gateways like this tend to be monitored far less closely than the servers behind them, which is exactly why attackers like them.
A note on the pattern
This is the third maximum-severity, pre-authentication SSRF in SMA1000 WorkPlace this year. In July, attackers exploited CVE-2026-15409 and CVE-2026-15410 as zero-days for weeks, installing custom malware (Sou5, OrangeTail, and RootRun) on vulnerable gateways, and CISA later linked some of that activity to ransomware groups. In September, attackers chained CVE-2026-83548 and CVE-2026-83549 to run code on SMA1000 appliances. Over the past four years, CISA has added 19 SonicWall vulnerabilities to its KEV catalog and flagged 13 of them as used by ransomware gangs.
The lesson is not specific to SonicWall. Internet-facing remote access appliances from every major vendor have been a leading way into corporate networks for several years, because they are reachable from anywhere, they are trusted by everything behind them, and they are frequently patched on slower cycles than the systems they protect. A product with three critical flaws in the same component in four months deserves a frank conversation about whether it is getting the attention its position warrants, and whether a single gateway should be able to reach as much of the network as it currently can.
Summary
| CVE | CVE-2026-102255 (plus CVE-2026-102256, CVE-2026-102257, CVE-2026-102258) |
| Component | SonicWall SMA1000 Appliance WorkPlace (Extraweb) |
| Type | Pre-authentication server-side request forgery (CWE-918) via an unintended alternate access path |
| CVSS | 10.0 (Critical) |
| Impact | Unauthenticated attacker can make the appliance send requests on their behalf, reach internal functionality, and perform unauthorized operations |
| Affected | SMA1000 6210, 7210, 8200v on 12.4.3-03526 and older, or 12.5.0-02952 and older |
| Not affected | SMA 100 Series; SSL-VPN on SonicWall firewalls |
| Disclosed | October 6, 2026 (SNWLID-2026-0017) |
| Exploited in the wild? | Exploitation attempts observed by Previdian honeypots on October 9; success not confirmed; SonicWall has not confirmed exploitation |
| CISA KEV? | Not listed as of the most recent checks |
| Workaround | None |
| Detection | OPTIONS requests to WorkPlace/Extraweb; references to 127.0.0.1:5984, _design, or _rewrite; Basic auth admin:admin |
| Full fix | Platform-hotfix 12.4.3-03670 or 12.5.0-03082 or later |
A maximum-severity flaw, no login required, attack traffic within three days, and a product with a track record of being exploited this year: this one belongs at the top of the queue. Check the build number on every SMA1000, apply the October hotfix even if you patched in September, and look back through the logs to make sure nobody got there first.
If you need help confirming your SMA1000 exposure, hunting for signs of compromise on remote access infrastructure, or putting monitoring around gateways that currently have little, get in touch. The device that lets your people in deserves at least as much scrutiny as the people it lets in.