Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Attackers are exploiting CVE-2026-102255, a CVSS 10 unauthenticated SSRF flaw in SonicWall SMA 1000 appliances.
SonicWall disclosed CVE-2026-102255 on October 6, a CVSS 10 server-side request forgery flaw in the SMA 1000 WorkPlace interface. A remote unauthenticated attacker can abuse an unintended alternate access path so the appliance issues requests and reaches internal functionality. Previdian and Defused reported exploitation attempts against honeypots and decoys on October 8-9, after SonicWall said it had no evidence of in-the-wild use. Technical details are unpublished; SOCRadar said the score suggests the bug may be easy to exploit.
- CVE-2026-102255 is an unauthenticated SSRF bug in SMA 1000 WorkPlace, scored CVSS 10.
- SonicWall published the advisory October 6 and initially reported no exploitation evidence.
- Previdian and Defused saw exploit attempts on honeypots within days.
- Three other CVEs were disclosed in the same advisory but not named here.
- CVEs
- CVE-2026-102255
- Vendors
- SonicWall
- Products
- SMA 1000Secure Mobile Access
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102255 | Pre-auth SSRF in SonicWall SMA1000 Work Place interface | 10.0 | <1% | PoC ×2 |
Indicators of compromise
auto-extracted · verify before use · export allAll| Type | Indicator | Context |
|---|---|---|
| md5 | 12d13374bd1fae4d1119efd354b926c6 | stolen-credentials-aws#recipe=similar-items&sourcecontentid=12d13374bd1fae4d1119efd354b926c6) 'TruffleNet' Attack Wields Stolen Credentials Against AWS |
| md5 | 42a3f64a30a24172cce0776514fc74fd | ntel-memory-encryption#recipe=similar-items&sourcecontentid=42a3f64a30a24172cce0776514fc74fd) Cheap Hardware Module Bypasses AMD, Intel Memory Encrypti |
| md5 | 7b70e2514592f68b16486d247d566d50 | itical-zero-click-bugs#recipe=similar-items&sourcecontentid=7b70e2514592f68b16486d247d566d50) Patch Now: Microsoft Flags Zero-Day & Critical Zero-Click |
| md5 | d705cceb54d730025cbc964fce146066 | tch-windows-server-bug#recipe=similar-items&sourcecontentid=d705cceb54d730025cbc964fce146066) Microsoft Issues Emergency Patch for Critical Windows Ser |
From the original article
8 min read at darkreading.com
Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.
By Rob Wright · darkreading.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.