critical Cve 2026 102255 · Exploits

SonicWall SMA1000 CVSS 10 Pre-Auth SSRF CVE-2026-102255 Draws Exploit Attempts Within Two Days

CVSS 10 poster: SonicWall SMA1000 pre-auth SSRF CVE-2026-102255, exploit attempts not confirmed compromise

Alex Kim
Threat intelligence editor · Published Oct 12, 2026, 9:26 PM EDT

SonicWall SMA1000 flaw CVE-2026-102255 (CVSS 10) saw exploit attempts two days after disclosure. Attempts, not confirmed compromise; here is who must patch.

SonicWall has patched CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) flaw in the Work Place interface of SMA1000 appliances, scored CVSS 3.1 10.0. Honeypot operators saw exploitation attempts starting October 8, two days after the advisory. Those are attempts, not confirmed compromises, and the flaw was not in CISA's Known Exploited Vulnerabilities (KEV) feed when we checked on October 13.

What happened

SonicWall published advisory SNWLID-2026-0017 on October 6; the NVD record for CVE-2026-102255 followed on October 7. The advisory covers four SMA1000 flaws. The other three are CVE-2026-102256 (post-authentication OS command injection), CVE-2026-102257 (path traversal) and CVE-2026-102258 (cross-site scripting), the last two in the Appliance Management Console and reachable only by an authenticated administrator. SonicWall credits Benoît Sevens of Anthropic for CVE-2026-102255 and CVE-2026-102256.

SonicWall's advisory, still at version 1.0 with no revision, says there is "currently no evidence" any of the four is exploited in the wild. SecurityWeek reports that Defused saw the first attempts against its SMA decoy systems on October 8. Previdian lists 135 attempts from two US source IP addresses on one sensor (24 on October 9, 111 on October 10); a Previdian post names a scanning source of 146.70.143[.]142, which is a source seen by a sensor, not an indicator of compromise. Help Net Security's October 12 update says it is not known whether any attempt succeeded against a real deployment.

Timeline of CVE-2026-102255 from the Oct 6 advisory to exploit attempts on Oct 8-10

Exploit attempts, not confirmed compromise: from the Oct 6 advisory to the first decoy hit two days later.

Why it matters

The NVD description says a remote, unauthenticated attacker can make the appliance send requests on their behalf, reach internal functionality and perform unauthorized operations. The CVSS vector is AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H: network reachable, low complexity, no privileges, no user interaction, changed scope. SonicWall scores it with CVSS 3.0 and the CISA entry in NVD uses 3.1; both give 10.0. CISA's SSVC entry in NVD, recorded on October 7, rates the vulnerability automatable with total technical impact, and recorded no exploitation at that point.

Appliances patched in September are still affected. CVE-2026-83548 (SNWLID-2026-0016, September 1, CVSS 10) is also a pre-auth SSRF in the Work Place interface "due to an unintended alternate access path", and CISA added it to KEV on September 2. Its fixed builds, 12.4.3-03526 and 12.5.0-02952, are exactly the newest builds the new advisory lists as affected. If you applied September's fix, you still need this one. SonicWall does not describe this as a bypass of the earlier patch; it is a separate CVE.

This is the third pre-auth SSRF in the SMA1000 Work Place interface this year: CVE-2026-15409 in July, CVE-2026-83548 in September and now CVE-2026-102255. Our report on the July zero-days CVE-2026-15409 and CVE-2026-15410 covers the first; the SMA1000 attack-chain triage guide covers the September flaw and what to check. Help Net Security notes SMA1000 is used by medium to large enterprises, managed security service providers and government agencies.

Technical details

NVD classifies the flaw as CWE-441 (unintended proxy or intermediary) and CWE-918 (SSRF); SonicWall's advisory calls it "pre-authentication SSRF via unintended forward-proxy". Details below are from the SonicWall advisory unless noted.

Affected: SMA1000 models 6210, 7210 and 8200v running 12.4.3-03526 (platform-hotfix) and older, or 12.5.0-02952 (platform-hotfix) and older.
Fixed: 12.4.3-03670 (platform-hotfix) and higher, or 12.5.0-03082 (platform-hotfix) and higher, available via mysonicwall.com.
Not affected: SSL-VPN on SonicWall firewalls, and the SMA 100 series.
Workaround: none, per SonicWall.

We found no published exploit code.

What defenders should do

Identify every SMA1000 appliance, including 6210, 7210 and 8200v virtual units, and its build number. Anything at or below 12.4.3-03526 or 12.5.0-02952 is affected, including appliances patched in September.
Upgrade to 12.4.3-03670 or 12.5.0-03082 or later. SonicWall lists no workaround.
Check whether the Work Place interface is reachable from the internet and restrict it if it does not need to be. This is general hardening, not a SonicWall-stated workaround.
Review web and appliance logs from October 6 onward for unexpected requests to Work Place paths, and for outbound connections the appliance should not make.
If you see anything suspicious, treat the appliance as possibly compromised. Patching does not remove an attacker who is already in, as SonicWall firewall owners found in the Akira ransomware campaign: rotate credentials and secrets stored on or reachable from the appliance.

What is still unclear

Whether any attack has succeeded against a production appliance. Reports so far describe attempts on decoys and sensors.
Whether CISA will add the flaw to KEV. It was absent from the feed released October 8, which we rechecked on October 13. SonicWall's advisory still says it knows of no exploitation, which may be why.