Critical SonicWall SMA 1000 SSRF Flaw Targeted in Exploitation Attempts
Summary
Security vendors observed attempts to exploit CVE-2026-102255, a maximum-severity SSRF flaw in SonicWall SMA 1000 appliances. SonicWall has released a hotfix and urges customers to apply it.
Key points
- CVE-2026-102255 is a maximum-severity SSRF vulnerability in the SMA 1000 WorkPlace interface, rated CVSS 10.0.
- The flaw could let unauthenticated remote attackers make the appliance issue requests to internal services and perform unauthorized operations.
- Previdian and Defused reported observing exploit attempts on honeypots or decoy devices.
- SonicWall previously said it had no evidence of in-the-wild exploitation; it did not respond to Dark Reading's request for comment on the third-party reports.
- SonicWall released a hotfix and urged customers to install it promptly.
- SonicWall says its firewalls' SSL-VPNs and SMA 100 Series products are not affected by this vulnerability.
Article Details
- Vulnerability Types
- Server-side request forgery (SSRF)
- Severity
- CVSS 10.0 (maximum severity)
- Exploitation Status
- reported
- Exploit Availability
- unknown
- Patch Status
- available
- Workarounds
- Apply the hotfix released by SonicWall.
MITRE ATT&CK
CVE
CVE-2026-102255CVE-2026-102255 is a server-side request forgery (SSRF) flaw in the SonicWall SMA 1000 appliance's WorkPlace interface, a Web-based portal for remote users. The vulnerability, which SonicWall assigned a maximum 10 outCVE-2026-15409products this year. In July, the Inc ransomware gang launched zero-day attacks exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, in SMA 1000 Series appliances.CVE-2026-15410In July, the Inc ransomware gang launched zero-day attacks exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, in SMA 1000 Series appliances.
People
Threat Actors
Vendors
Coalitionof threat actors in recent years. Joe Toomey, vice president of underwriting security at cyber insurer Coalition, says the risk posed by such devices and their frequently exploited vulnerabilities is quantifiable, asDefusedmedia platform X that it had observed attempts to exploit its sensors. Similarly, cybersecurity vendor Defused noted on X that it saw unauthenticated SSRF traffic on the company's SonicWall SMA decoys starting thePrevidianfor CVE-2026-102255 on their honeypot devices. On Oct. 9, cybersecurity threat intelligence firm Previdian warned in a post on the social media platform X that it had observed attempts to exploit its sensors.SOCRadarthe vulnerability's CVSS score suggests the flaw may be trivial to exploit. In a blog post on Monday, SOCRadar researchers noted that successful exploitation of the flaw on SMA 1000 appliances will give an attackerSonicWallMaximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
Products
Secure Mobile Accessa maximum-severity vulnerability in the cybersecurity vendor's unified secure access gateway, the Secure Mobile Access (SMA) appliance.SMA 100 Seriesit as soon as possible. The cybersecurity vendor said SSL-VPNs running on SonicWall firewalls or the SMA 100 Series product line are not affected by CVE-2026-102255 or the other three CVEs disclosed last week.SMA 1000Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.WorkPlaceCVE-2026-102255 is a server-side request forgery (SSRF) flaw in the SonicWall SMA 1000 appliance's WorkPlace interface, a Web-based portal for remote users. The vulnerability, which SonicWall assigned a maximum 10 out