SonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
Attackers are exploiting SonicWall SMA 1000 pre-auth SSRF CVE-2026-102255, a CVSS 10.0 flaw with no workaround.
Attackers are exploiting CVE-2026-102255, a pre-authentication server-side request forgery in the SonicWall SMA 1000 Work Place interface, scored CVSS 10.0. It affects models 6210, 7210, and 8200v on 12.4.3-03526, 12.5.0-02952, and earlier; firewall SSL-VPN and the SMA 100 series are not affected. A hotfix is available through MySonicWall and there is no workaround. Defused and Previdian reported unauthenticated SSRF attempts since October 8, 2026, including 135 attempts from two US addresses, one given as 146.70.143.142. SonicWall said it found no exploitation evidence and has not updated its advisory.
- CVE-2026-102255 is a pre-auth SSRF scored CVSS 10.0.
- SMA 1000 models 6210, 7210, and 8200v need the hotfix.
- No workaround; firewall SSL-VPN and SMA 100 are unaffected.
- Defused and Previdian reported live exploitation attempts since October 8.
- Previdian counted 135 attempts from two United States IP addresses.
- CVEs
- CVE-2026-102255
- Vendors
- SonicWall
- Countries
- United States
Vulnerabilities mentioned
All| CVE | Vulnerability | CVSS | EPSS | Signals | Published |
|---|---|---|---|---|---|
| CVE-2026-102255 | Pre-auth SSRF in SonicWall SMA1000 Work Place interface | 10.0 | <1% | PoC ×2 |
From the original article
2 min read at securityaffairs.com
Attackers are exploiting SonicWall SMA 1000 vulnerability, tracked as CVE-2026-102255 (CVSS score of 10. 0), just days after its public disclosure. Attackers have begun exploiting a critical flaw in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255 (CVSS score of 10.
By Pierluigi Paganini · securityaffairs.com
A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.