Two days after SonicWall released a patch for CVE-2026-102255, threat intelligence firm Previdian logged the first exploitation attempts against it. By the time its count went public, 135 attempts had come from two unique IP addresses, both in the U.S. Defused Cyber saw unauthenticated SSRF traffic hitting its SonicWall SMA decoys starting October 8, the day before Previdian's post.
The flaw is a pre-authenticated server-side request forgery in the SMA 1000 appliance's WorkPlace interface, the web portal remote users log into. SonicWall rated it 10.0 and traced it to an "unintended alternate access path." An unauthenticated attacker can make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations. The fix shipped October 6 in 12.4.3-03670 and 12.5.0-03082, both platform hotfixes.
SonicWall's advisory still says there is "currently no evidence" that this CVE or the three others disclosed alongside it have been exploited in the wild. That was accurate when written. It now sits behind the honeypot data, and SonicWall has not updated it. Dark Reading asked the company about the third-party reports and got no response by press time.
What an SSRF buys an attacker depends on where the box sits, and SMA 1000 sits in a bad place for the defender. It fronts SSL VPN, clientless remote access, and zero-trust access to corporate resources, so it has routes into identity services, internal applications, and network infrastructure that are not meant to be reachable from the internet. SOCRadar's read is that successful exploitation hands an attacker control of the WorkPlace interface and turns the gateway into a proxy into those internal services. The technical details of CVE-2026-102255 have not been published, but a 10.0 on a pre-auth bug suggests the path is short.
This is the same product line that was under zero-day attack earlier in the year. The sources disagree on who and when: The Hacker News attributes June 2026 attacks on CVE-2026-15409 and CVE-2026-15410 to a group tracked as UTA0533, which deployed Java web shells and malware called KNUCKLEBALL; Dark Reading places the attacks in July and attributes them to the Inc ransomware gang. Both describe the same two CVEs in the same appliance.
Rapid7's account of those earlier intrusions is the useful part for anyone running one of these. Once attackers had a foothold on the appliance, they pulled high-value credentials, active session databases, and TOTP MFA seed configurations off it, then used that haul to move laterally straight into the internal network. The MFA seeds matter: an attacker holding them can generate valid one-time codes, so patching the appliance after a compromise does not undo the exposure.
The immediate action is the obvious one. SSL-VPNs on SonicWall firewalls and the SMA 100 Series are not affected by this CVE or the other three. If you run SMA 1000, patch to 12.4.3-03670 or 12.5.0-03082, and if the box was internet-facing before you patched, treat the secrets stored on it as suspect and rotate credentials, invalidate sessions, and reseed MFA rather than just cleaning the device.
The longer argument comes from Joe Toomey, who underwrites security risk at cyber insurer Coalition. He says edge devices and SSL VPNs are where the claims come from. "There are none of them that are good, and there are some that are worse." Coalition prices on what it can see exposed from your network and on its claims history with your vendor, so a bad vendor costs you a higher premium. His recommendation is to move off legacy SSL-VPN appliances toward zero-trust access, which he says would both lower the premium and lower the odds of a claim.
Top comments (0)