SonicWall Patches Critical Pre-Auth SSRF in SMA1000 Appliances
Summary
CVE-2026-102255 is a critical pre-auth SSRF affecting SonicWall SMA1000 appliances. Exploitation attempts were observed in honeypots and decoys, but production compromise has not been established. SonicWall has released hotfixes.
Key points
- The flaw affects the WorkPlace interface on SMA1000 6210, 7210, and 8200v appliances, including supported virtual deployments.
- Affected builds are 12.4.3-03526 and earlier, and 12.5.0-02952 and earlier; fixed versions are 12.4.3-03670 or later and 12.5.0-03082 or later.
- The pre-auth SSRF could let a remote unauthenticated attacker direct the appliance to reach internal services and perform unauthorized operations; independent RCE or complete appliance compromise has not been established.
- Researchers reported crafted OPTIONS requests targeting an internal CouchDB service at 127.0.0[.]1:5984; these observations are not confirmed indicators of compromise.
- Honeypot and decoy activity suggests exploitation attempts, but successful compromise of production systems has not been publicly established. No public PoC was reported as of early October.
- Install SonicWall's fixed hotfixes. Until patched, restrict WorkPlace exposure and unnecessary outbound access, and review appliance telemetry for suspicious requests and changes.
Article Details
- Vulnerability Types
- Server-Side Request Forgery (SSRF)
- Severity
- Critical (CVSS 10.0)
- Affected Versions
- SMA1000 12.4.3-03526 and earlier
- SMA1000 12.5.0-02952 and earlier
- Exploitation Status
- reported
- Exploit Availability
- none_reported
- Patch Status
- available
- Workarounds
- Restrict unnecessary exposure of the WorkPlace interface.
- Isolate the Appliance Management Console from public and user-facing networks.
- Limit outbound appliance access to required internal services.
- Prevent unnecessary connectivity to databases, directories, and management systems.
CVE
Vendors
Products
CouchDBThe observed traffic reportedly targeted the WorkPlace Extraweb interface with crafted OPTIONS requests intended to reach an internal CouchDB service at 127.0.0[.]1:5984.SMA1000CVE-2026-102255: Critical SonicWall SMA1000 SSRFWorkPlaceSonicWall has patched CVE-2026-102255, a critical pre-authentication Server-Side Request Forgery (SSRF) vulnerability affecting the WorkPlace interface of SMA1000 appliances.