Active exploitation alert

CVE-2026-102255: SonicWall SMA 1000 Critical SSRF Vulnerability Exploited in Attacks

13/10/20266 min read

SonicWallActive ExploitationSSRFCVE-2026-102255SMA 1000Critical

Security researchers have reported exploitation attempts targeting CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF flaw in SonicWall SMA 1000 appliances. The vulnerability may let remote unauthenticated attackers reach internal appliance functionality; organisations should urgently patch affected devices and investigate suspicious activity.

Impacted systems

Software / application	Version / scope
SonicWall Secure Mobile Access (SMA) 1000 Series — models 6210, 7210 and 8200v	12.4.3-03526 and older; 12.5.0-02952 and older

Exploitation conditions

CVE-2026-102255 is a pre-authentication SSRF vulnerability in the SMA 1000 Appliance WorkPlace interface caused by an unintended alternate access path. A remote unauthenticated attacker may abuse the interface to make the appliance issue requests to internal functionality and perform unauthorised operations. Security researchers reported exploitation attempts against honeypots after disclosure. Public reporting describes crafted HTTP OPTIONS requests and attempts to reach the appliance's local CouchDB service; treat these details as investigative leads, not proof that a particular device has been compromised.

Recommended action

Upgrade affected SMA 1000 appliances immediately to SonicWall's fixed hotfix releases: 12.4.3-03670 or later, or 12.5.0-03082 or later, as applicable. Confirm the current supported release with SonicWall.
Review appliance, web interface, reverse-proxy, network and available system logs for unusual HTTP OPTIONS requests, unexpected access to the WorkPlace interface, and requests or connections involving local/internal services such as CouchDB on 127.0.0.1:5984.
Look for unexpected administrative actions, configuration changes, new accounts, anomalous processes, and unusual outbound connections. Preserve relevant logs and escalate suspected compromise to your incident response team and SonicWall Support.
If compromise is suspected, follow your incident response process to isolate or restrict the appliance where operationally safe, preserve evidence, rotate potentially exposed credentials, and assess connected internal systems.
Restrict management and remote-access interfaces to trusted networks where possible.

Workarounds

No workaround released in advisory.If patching cannot be completed immediately, restrict exposure to the affected interface and allow access only from trusted networks where operationally feasible. This is temporary risk reduction, not a replacement for patching.

Sources

Continue

More notes and updates.

All reports →