Previdian, Defused: SonicWall SMA1000 SSRF SSRF probes hit unpatched gateways 2 days post-fix

SonicWall SMA1000 appliances face immediate exploitation attempts for a critical server-side request forgery vulnerability. The vendor issued patches on October 6, 2026, but threat actors began targeting the flaw within two days of public disclosure.

What happened

SonicWall disclosed CVE-2026-102255 on October 6, 2026, releasing software updates for specific SMA1000 models. The vulnerability carries a CVSS score of 10.0, indicating maximum severity. It affects the WorkPlace interface on SMA1000 6210, 7210, and 8200v models. The flaw does not impact the SMA 100 Series product line or SSL-VPN services running on SonicWall firewalls.

According to SonicWall, the defect allows a remote, unauthenticated attacker to direct the appliance to issue requests on their behalf. This mechanism can reach internal functionality and perform unauthorized operations. The company urged customers to update to software versions 12.5.0-03082 and 12.4.3-03670.

Threat intelligence firms Previdian and Defused reported exploitation attempts on October 8, 2026. Previdian founder Ryan Dewhurst noted that requests targeted the WorkPlace Extraweb interface using crafted OPTIONS requests. These payloads attempted to access the internal CouchDB service at 127.0.0.1:5984.

Dewhurst explained that the attack tried to traverse into a CouchDB design document and invoke its _rewrite function. The payload included an HTTP Basic Authorization header with default credentials. Defused confirmed observing unauthenticated SSRF traffic against its SonicWall SMA decoys starting on October 8.

Previdian data shows 135 exploitation attempts from two unique IP addresses in the U.S. The firm has not confirmed whether these attempts successfully compromised any live systems. SonicWall has not yet updated its advisory to reflect active exploitation in the wild.

Why it matters

SMA1000 appliances are enterprise-grade secure remote access gateways used by many organizations. Managed service providers, large corporations, and government agencies often deploy them for VPN access to internal applications. Shadowserver currently tracks more than 400 SMA1000 appliances exposed online.

This vulnerability follows earlier SSRF flaws disclosed in July and September 2026. Those previous issues targeted the same WorkPlace interface but used different exploitation techniques. In June 2026, threat actor UTA0533 weaponized other SMA1000 flaws to deploy Java web shells.

Rapid7 noted that attackers previously used such footholds to extract credentials and MFA seed configurations. This allowed lateral movement into internal corporate networks. The rapid exploitation of CVE-2026-102255 suggests similar risks for unpatched systems.

What to watch

• Monitor for unusual OPTIONS requests targeting the WorkPlace Extraweb interface.
• Check logs for connections to internal CouchDB services from external sources.
• Verify that SMA1000 appliances are running patched software versions 12.5.0-03082 or 12.4.3-03670.
• Review network traffic for signs of lateral movement from compromised gateways.

Who needs to act first

Teams should prioritize updating internet-facing SMA1000 appliances immediately. Identify all 6210, 7210, and 8200v models in the environment. Apply the vendor patches to these systems first. Test the updates in a non-production environment if possible. Back up configurations before making changes. Isolate unpatched devices from the internet if immediate patching is not feasible.

Background: IP addresses

An IP address is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. This guide answers ten common questions about IPv4 and IPv6 mechanics, subnetting, NAT, and security implications to clarify how these identifiers function in modern infrastructure.

Read the full guide: IP Address Mechanics: 10 Questions Network Engineers Actually Ask

What to do and how to stay safe: SonicWall

• Inventory all SonicWall SMA1000 appliances and verify their current software versions against the patched releases.
• Restrict access to the WorkPlace Extraweb interface using firewall rules or network segmentation where possible.
• Monitor network logs for unauthorized internal requests originating from SMA1000 appliances.
• Review authentication mechanisms on internal services like CouchDB to ensure default credentials are changed.

Step-by-step guide: Software Updates Best Practices: Secure Patching Without Downtime

General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which SonicWall products are affected by CVE-2026-102255?

The flaw affects SMA1000 6210, 7210, and 8200v models. It does not affect the SMA 100 Series or SSL-VPN on SonicWall firewalls.

Is there a patch available for this vulnerability?

Yes, SonicWall released patches on October 6, 2026. Customers should update to versions 12.5.0-03082 or 12.4.3-03670.

Has this vulnerability been exploited in the wild?

Threat intelligence firms detected exploitation attempts against honeypots. SonicWall has not confirmed successful compromises of live systems.