Summary
On October 6, 2026, SonicWall published advisory SNWLID-2026-0017 disclosing CVE-2026-102255, a CVSS 10.0 pre-authentication server-side request forgery (SSRF) vulnerability in the SMA1000 series secure access appliances. An unauthenticated remote attacker can abuse the appliance's WorkPlace interface to force it into issuing attacker-chosen requests — reaching internal functionality and services the attacker could never touch directly. Honeypot telemetry recorded real exploitation attempts within roughly 24 hours of disclosure. This is the third pre-authentication SSRF in the same WorkPlace interface this year — and the two before it were both exploited in the wild. There is no workaround. Patching is the only fix.
Severity
CVE ID: CVE-2026-102255
Title: SonicWall SMA1000 pre-authentication SSRF vulnerability (WorkPlace interface)
CVSS 3.1: 10.0 (Critical) — scope changed
Attack requirements: None — unauthenticated, remote
Root cause: An unintended alternate access path in the SMA1000 WorkPlace interface
Exploited in the wild: Yes — attempts observed ~24 hours after disclosure (Previdian honeypots, October 9)
Workaround: None available
A 10.0 with scope changed means the vulnerable component (the appliance) can be abused to impact resources beyond its own security scope — here, the appliance's internal services. That single line is the entire SSRF story: the attacker never attacks the internal service directly. They make the appliance do it for them.
Affected Versions
The vulnerability affects the SMA1000 series — specifically the SMA 6210, SMA 7210, and 8200v models:
Firmware 12.4.3-03526 and older — vulnerable
Firmware 12.5.0-02952 and older — vulnerable
Fixed in: 12.4.3-03670 and 12.5.0-03082. The SMA 100 series and the SSL-VPN feature on SonicWall firewalls are not affected — this is strictly an SMA1000 problem.
The same advisory also fixed three post-authentication flaws worth noting for completeness: CVE-2026-102256 (7.8, OS command injection, authenticated), CVE-2026-102257 (7.2, Zip Slip path traversal, authenticated), and CVE-2026-102258 (5.5, stored XSS, authenticated). Post-auth means they need valid credentials first — serious, but a different league from a 10.0 that needs nothing.
Technical Analysis
SSRF, explained plainly. Server-side request forgery is a confused-deputy attack. The appliance is a trusted party: it legitimately talks to internal services, management interfaces, and databases that the outside world cannot reach. The vulnerability — an unintended alternate access path in the WorkPlace interface — lets an attacker hand the appliance a crafted request and have it execute that request with its own privileges. The firewall rules that protect internal services from the internet are irrelevant, because the request now originates from inside, from a trusted device. The attacker never crosses the boundary; they get the appliance to do the crossing.
What the honeypots caught. Previdian's telemetry from October 9 shows attackers probing the WorkPlace Extraweb interface with a crafted HTTP OPTIONS request. The observed payload forces the appliance to open a connection to its own internal CouchDB instance at 127.0.0.1:5984, traverse a CouchDB design document, and invoke the _rewrite handler — authenticated to the database with HTTP Basic auth as admin:admin. Read that sequence slowly, because every step is damning: the appliance runs a database on localhost with default credentials, that database is reachable through the vulnerable code path, and the attacker walks straight through it. This is reconnaissance-grade exploitation — attackers mapping what the flaw can reach — but it demonstrates the full internal attack surface is exposed.
The pattern that should alarm everyone. This is the third pre-authentication SSRF in the same WorkPlace interface in 2026. CVE-2026-15409 in July and CVE-2026-83548 in September were both exploited in the wild, and both ended up in the CISA Known Exploited Vulnerabilities catalog. Three times in nine months, the same interface, the same flaw class, each one exploited. That is not bad luck — that is a codebase whose request-handling code has a systemic problem, being fixed one instance at a time while attackers watch for the next one. Defenders should internalize the lesson: when the same flaw class recurs in the same interface, the next advisory is a matter of time, and the patching posture for that product should be "emergency" by default.
24 hours. SonicWall stated it had no evidence of exploitation at disclosure. The honeypots say attackers began probing within about a day. Both can be true — and that is exactly the point. "No evidence of exploitation" at disclosure is a snapshot of the vendor's visibility, not a prediction of the future. For a 10.0 pre-auth flaw in a perimeter appliance, the weaponization clock starts the moment the advisory publishes, because the advisory itself tells attackers exactly where to look.
Why the appliance is the worst possible SSRF victim. An SSRF on a random web app reaches that app's internal network. An SSRF on a secure access gateway reaches the network the gateway exists to protect — plus its own management plane, its credential stores, and its internal databases (as demonstrated). The SMA1000 sits at the edge, authenticated to everything, trusted by everything. Turning it into a confused deputy does not just compromise a device; it compromises the trust model of the whole remote-access architecture. Worse, the gateway's logs will show the malicious traffic as its own internal communications, which is exactly the kind of activity most monitoring rules are written to ignore.
Why This Matters
Secure access appliances are the front door of the corporate network — and unlike a collaboration tool, they are supposed to be internet-facing. You cannot "take it off the internet" as a mitigation, because internet exposure is its job. That makes a pre-auth 10.0 with no workaround the worst-case category of flaw for this product type: every exposed SMA1000 is one unpatched firmware away from becoming an attacker's internal proxy.
This also continues a pattern across this month's enterprise disclosures — critical access-control and request-handling flaws in widely deployed on-prem products, including the Exchange authorization flaw covered earlier this month. The perimeter keeps being the login page — and in this case, the flaw does not even need the login page.
Mitigation
Patch immediately — there is no workaround. Upgrade to 12.4.3-03670 (12.4.x branch) or 12.5.0-03082 (12.5.x branch). SonicWall published no mitigation short of the firmware update; do not waste time looking for one.
Hunt for prior exploitation. If your appliance was exposed and unpatched between October 6 and your upgrade, review WorkPlace and appliance logs for crafted HTTP OPTIONS requests against the Extraweb interface, and any unexpected connections to localhost services (127.0.0.1:5984) or internal resources originating from the appliance itself. SSRF exploitation looks like the appliance talking to itself — log sources that show source and destination clearly are what you need.
Rotate internal credentials. The observed PoC used admin:admin against the internal CouchDB. Change default credentials on every internal service the appliance hosts, and treat any internal service reachable through the appliance as potentially touched.
Watch for the KEV listing. The two predecessor SSRFs (CVE-2026-15409, CVE-2026-83548) both reached CISA KEV. If this one follows — and the exploitation telemetry suggests it will — expect a binding patch deadline for federal systems and treat it as your own deadline too.
Reassess the product's patch posture. Three pre-auth SSRFs in nine months in one interface means SMA1000 firmware updates should be handled as emergency changes, not scheduled maintenance, until the pattern breaks.
References
SonicWall security advisory SNWLID-2026-0017 (published October 6, 2026)
Previdian honeypot telemetry on exploitation attempts (October 9, 2026)
CISA Known Exploited Vulnerabilities catalog — CVE-2026-15409, CVE-2026-83548 (prior SMA WorkPlace SSRFs)
NVD entry for CVE-2026-102255
Report by Faizan Akhtar — The Cyber Security Researcher
Top comments (0)