US Targeted in Unauthenticated SSRF Attacks on SonicWall SMA 1000 Appliances
Unauthenticated attacks target SonicWall SMA 1000 appliances via CVE-2026-102255, prompting urgent patching despite vendor claims of no known exploitation.
Key points
- Attackers are actively exploiting an unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
- The vulnerability, CVE-2026-102255, has a CVSS score of 10.0 and allows unauthorized internal access.
- SonicWall has released a hotfix, though it states no exploitation evidence was initially found.
Attackers have begun exploiting a critical server-side request forgery vulnerability in SonicWall SMA 1000 appliances shortly after its public disclosure. Security researchers report active exploitation attempts from the United States, contradicting the vendor’s initial statement that no exploitation had been observed.
What happened
SonicWall released a patch for CVE-2026-102255, a server-side request forgery (SSRF) flaw affecting SMA 1000 appliances. According to Security Affairs, the vulnerability carries a CVSS score of 10.0 and requires no authentication for exploitation. An attacker can abuse an unintended alternate access path in the Work Place interface to direct the appliance to issue requests on their behalf. This allows unauthorized access to internal functionality and operations.
View the original post on X
View the original post on X
The vendor stated it found no evidence of exploitation at the time of the advisory but recommended applying the fix immediately. A hotfix is available through the MySonicWall portal, with no workaround provided. The flaw does not affect SSL-VPN on SonicWall firewalls or the SMA 100 Series product line.
Despite the vendor’s initial assessment, multiple researchers warn of active exploitation. Cybersecurity firm Defused detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys starting October 8, 2026. Defused alerted subscribers through its Radar service about the activity.
Previdian also confirmed exploitation attempts targeting SonicWall SMA 1000 appliances consistent with CVE-2026-102255. According to Previdian, researchers recorded 135 attack attempts from two different IP addresses in the United States. One reported attacker IP address is 146.70.143[.]142. SonicWall has not yet updated its security advisory to confirm these exploitation reports.
Why it matters
The speed of exploitation highlights the risk of high-severity vulnerabilities in network management appliances. The unauthenticated nature of CVE-2026-102255 means attackers can reach internal systems without credentials. This bypasses standard perimeter defenses and allows direct interaction with internal functions. Organizations relying on SMA 1000 for network management face immediate exposure if unpatched.
The discrepancy between the vendor’s initial claim of no exploitation and researcher findings underscores the importance of independent threat intelligence. Defused and Previdian data provides early warning of real-world abuse. This gap can leave organizations vulnerable during the window between disclosure and vendor confirmation. The CVSS 10.0 rating indicates the maximum severity, requiring urgent attention from IT managers.
What to watch
- Monitor for unauthenticated traffic patterns targeting SMA 1000 Work Place interfaces.
- Watch for new advisories from SonicWall confirming active exploitation.
- Track security alerts from firms like Defused and Previdian for updated attacker IPs.
- Review logs for requests originating from known malicious IP addresses such as 146.70.143[.]142.
Background: IP addresses
An IP address is a numerical label assigned to each device connected to a computer network that uses the Internet Protocol for communication. This guide answers ten common questions about IPv4 and IPv6 mechanics, subnetting, NAT, and security implications to clarify how these identifiers function in modern infrastructure.
Read the full guide: IP Address Mechanics: 10 Questions Network Engineers Actually Ask
What to do and how to stay safe: SonicWall
- Verify if your organization uses SonicWall SMA 1000 appliances and check current firmware versions against the advisory.
- Apply the available hotfix through the MySonicWall portal as soon as possible to mitigate the SSRF risk.
- Segment SMA 1000 appliances from critical internal networks to limit access if patching is delayed.
- Monitor network logs for unusual outbound requests from management consoles that may indicate SSRF abuse.
General security guidance from the Patch Gazette newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Is CVE-2026-102255 being actively exploited?
Yes, researchers from Defused and Previdian have detected active exploitation attempts from the United States since October 8, 2026.
Does this vulnerability affect SonicWall firewalls?
No, the flaw does not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line.
Is there a workaround for this vulnerability?
No, SonicWall stated there is no workaround and users must apply the available hotfix through the MySonicWall portal.
