SonicWall SMA1000 CVSS 10 flaw now seeing exploitation attempts

SonicWall SMA1000 CVSS 10 flaw now seeing exploitation attempts

10 October 2026: Attackers are now probing SonicWall SMA1000 appliances for CVE-2026-102255, a pre-authentication server-side request forgery in the Appliance Work Place interface with a CVSS score of 10.0. Security firm Previdian has logged 135 attempts and rates the flaw as under active exploitation, so any appliance still on an unpatched build should be treated as a target.

Not yet independently verified. The exploitation attempts were recorded by one company's sensor and are not confirmed compromises, and SonicWall itself still reports no exploitation. The CouchDB detail comes from a researcher quoted by SC World. We will update this when it can be confirmed, and remove this note.

What Previdian's sensor recorded

Previdian's page shows no attempts from 4 to 8 October, 24 on 9 October and 111 on 10 October, all from two IP addresses in the United States and all seen by a single sensor. It reports attempts only, with no confirmed compromise, and says the flaw is not in the CISA Known Exploited Vulnerabilities catalogue. It rates the likelihood of exploitation as 0.5% on the EPSS scale.

The free page does not show the attacker addresses, the request paths or the payloads, and those details are held back for paying customers. Previdian's timeline puts the CVE publication on 7 October, its first recorded indicators early on 9 October and a virtual patch for web application firewalls later that day.

SonicWall's own advisory, SNWLID-2026-0017, first published on 6 October and not updated since, still says there is no evidence that any of the flaws is being exploited in the wild. We covered the flaw in our 7 October item.

The third CVSS 10 request-forgery flaw in nine months

Denis Calderone, chief technology officer at Suzu Labs, told SC World this is the third CVSS 10.0 pre-authentication request forgery in the Work Place interface in nine months, after July and September. Each lets an unauthenticated attacker make the appliance proxy requests to internal services that were never meant to be reachable from outside.

He says the attempts are aimed at the CouchDB service on localhost, and that a public Metasploit module written for the September chain already shows how CouchDB access leads to root-level code execution on these appliances. Previdian classes the weakness as CWE-918 and CWE-441, an unintended proxy.

Calderone's sharpest point concerns patching history: the firmware released in September to fix the last chain is, he says, exactly what this flaw affects, so every appliance patched after September is exposed again.

Affected models and fixed builds

Affected models are the SMA1000 6210, 7210 and 8200v running these builds or older:

• 12.4.3-03526 (platform-hotfix)
• 12.5.0-02952 (platform-hotfix)

The SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected. SonicWall's advisory lists no workaround and gives the fixed builds as 12.4.3-03670 and 12.5.0-03082 (platform-hotfix) or later, downloadable from MySonicWall. The same advisory fixes three post-authentication flaws alongside it: CVE-2026-102256 and CVE-2026-102257, both leading to code execution, and CVE-2026-102258, a stored cross-site scripting bug.

The appliance reboots during installation and drops every VPN session, so he advises a short maintenance window, an exported configuration and console access in hand beforehand, and not applying the hotfix over the VPN itself.

What to look for after patching

SonicWall has published no indicators of compromise for this flaw, unlike the July advisory. Calderone says the internal architecture is unchanged, so the July patterns still apply:

• unexpected routes in /var/lib/unit/conf.json
• HTTP 200 responses to /api/login or /api/logout in extraweb_access.log
• path traversal entries in ctrl-service.log
• authentication attempts from the appliance's own address against the company's domain controllers

If anything looks wrong he recommends re-imaging before installing the new firmware: "Patching a compromised box just gives you a patched compromised box."

Why not wait for a CISA listing

CVE-2026-102255 was still missing from CISA's Known Exploited Vulnerabilities catalogue in its 14 October release, which lists earlier SMA1000 flaws from July and September. Shane Barney, chief information security officer at Keeper Security, says SSRF flaws in edge appliances bypass the perimeter entirely, and that "security teams cannot afford to take a 'wait and see' approach" over the catalogue entry. He advises isolating the Work Place interface from the public internet if patching must wait, and reviewing logs for unusual outbound or internal requests.

Jason Soroko, senior fellow at Sectigo, notes that multifactor authentication does not close this route, because the appliance that controls remote access is itself the entry point. On the unconfirmed attempts he says: "That distinction matters for reporting, but security teams already have enough evidence to act."

Our VPN software category lists 13 products and our network security software category lists six.

Company profile on TrustList: SonicWall

Update, 22 October 2026: NVD published CVE-2026-102255 on 7 October with a CVSS 3.1 score of 10.0, describing a pre-authentication server-side request forgery in the SMA1000 Work Place interface. The flaw was not in CISA's catalogue of exploited vulnerabilities as of 21 October.

Related on TrustList:

• ChromeOS 16805.33.0 fixes 106 Chrome bugs, five of them Critical
• Seven countries tie old exploited flaws to China's Integrity Tech
• SonicWall patches CVSS 10 pre-login flaw in SMA1000 gateways

Sources

• SonicWall PSIRT: SNWLID-2026-0017, SonicWall SMA1000 series appliances affected by multiple vulnerabilities, 6 October 2026
• Previdian: CVE-2026-102255 Exploitation Observed, SMA1000, 10 October 2026
• SC World: 10.0 SonicWall SSRF bug now exploited in SMA1000 Appliance Work Place, 10 October 2026
• Security Affairs: SonicWall fixes max-severity pre-auth flaw in SMA1000 appliances, 7 October 2026
• CISA: Known Exploited Vulnerabilities catalogue, release 2026.10.14 (read 2026-10-15), 15 October 2026
• NVD: CVE-2026-102255 - 7 October 2026