SonicWall SMA 1000 SSRF: Rapid Probes Spike After Patch, Contradicting Vendor's Wild Exploit Claim
Attackers target unauthenticated server-side request forgery in SonicWall appliances, with threat firms logging probes shortly after vendor disclosure.
Key points
- CVE-2026-102255 is a CVSS 10.0 SSRF flaw in the SMA 1000 Work Place interface.
- Defused and Previdian detected exploitation attempts beginning on 8 October 2026.
- SonicWall released a hotfix on 6 October 2026 but stated no evidence of wild exploitation.
SonicWall SMA 1000 appliances contain a critical server-side request forgery vulnerability, tracked as CVE-2026-102255. The flaw resides in the Work Place interface and allows remote, unauthenticated attackers to force the device to send requests to internal services. This behaviour enables unauthorized operations without requiring valid credentials or user interaction, according to Security Affairs.
Root cause
The vulnerability stems from an unintended alternate access path within the SMA 1000 software. This path effectively turns the appliance into a forward proxy for malicious actors. SonicWall classifies the issue under CWE-918 for SSRF and CWE-441 for an unintended proxy, also known as a confused deputy. The CVSS vector indicates network-based exploitation with low complexity and high impact on confidentiality, integrity, and availability.
View the original post on X
View the original post on X
Attack path
Threat intelligence firms have observed active targeting of this flaw. Defused reported suspicious traffic against its SMA decoys starting on 8 October 2026, which was two days after the vendor released fixes. Previdian detected attempts consistent with CVE-2026-102255 from two IP addresses in the United States, recording 135 attempts in total. These observations suggest attackers are probing for vulnerable systems rapidly after disclosure.
Affected versions
The vulnerability affects SonicWall SMA 1000 series appliances. SonicWall clarified that the flaws do not impact SSL-VPN running on its firewalls or the SMA 100 Series product line. The advisory SNWLID-2026-0017 also covers three other issues: CVE-2026-102256 (command injection), CVE-2026-102257 (Zip Slip), and CVE-2026-102258 (stored cross-site scripting).
Mitigation
SonicWall released a hotfix available through the MySonicWall portal on 6 October 2026. The vendor stated there is no workaround for these vulnerabilities. While SonicWall initially reported no evidence of exploitation, multiple researchers warn that the flaw is now being actively targeted. Users must install the update to protect their infrastructure from unauthenticated access.
What to do and how to stay safe: SonicWall
- Verify if your environment runs SonicWall SMA 1000 appliances and check for pending updates.
- Review network logs for unusual outbound traffic originating from the SMA 1000 management interface.
- Monitor for connections to internal services that the appliance should not normally access.
- Apply the vendor-provided hotfix as soon as possible, as no alternative mitigation exists.
Step-by-step guide: Out-of-band patches: what small businesses need to know
General security guidance from the Firewall Pulse newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is the SonicWall SMA 1000 SSRF flaw being exploited in the wild?
Yes, threat firms Defused and Previdian detected exploitation attempts beginning on 8 October 2026, shortly after the patch release.
Does this vulnerability affect SonicWall firewalls or the SMA 100 Series?
No, SonicWall stated that the flaws do not impact SSL-VPN on firewalls or the SMA 100 Series product line.
Are there any workarounds for CVE-2026-102255?
No, SonicWall pointed out that there is no workaround; users must install the available hotfix.
