cyber.hendryadrian.com
Vulnerability & Exploit · bleepingcomputer.com

Exploitation Attempts Target Patched SonicWall SMA1000 Flaw

· Original article ↗

Summary

Researchers observed exploitation attempts against CVE-2026-102255, a maximum-severity flaw in certain SonicWall SMA1000 appliances. SonicWall patched it three days earlier, but researchers have not confirmed successful compromises.

Key points

  • CVE-2026-102255 affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models; SMA 100 Series and firewall SSL-VPN are not affected.
  • The flaw could let a remote unauthenticated attacker make the appliance issue requests and reach internal functionality to perform unauthorized operations.
  • SonicWall issued a patch three days before the reported exploitation attempts.
  • Previdian said its honeypots saw crafted OPTIONS requests targeting the WorkPlace Extraweb interface and internal CouchDB service, including an attempted _rewrite call and admin:admin credentials.
  • Researchers said the activity was consistent with exploitation attempts but had not established whether any systems were successfully compromised.
  • Shadowserver tracks more than 400 SMA1000 appliances exposed online, but the number that are patched or honeypots is unknown.

Article Details

Vulnerability Types
  • Server-side request forgery (SSRF)
Severity
Maximum severity
Affected Versions
  • SMA1000 6210
  • SMA1000 7210
  • SMA1000 8200v
Exploitation Status
reported
Exploit Availability
unknown
Patch Status
available

MITRE ATT&CK

T1190 · Exploit Public-Facing ApplicationReported attempts exploited CVE-2026-102255 against the SMA1000 WorkPlace interface, a remotely accessible appliance interface.

CVE

CVE-2026-102255Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago.CVE-2026-15409For instance, in July, threat actors abused two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances.CVE-2026-15410For instance, in July, threat actors abused two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances.CVE-2026-83548Last month, SonicWall also warned customers that attackers were chaining two new zero-days (CVE-2026-83548 and CVE-2026-83549) in the wild to execute remote code on vulnerable SMA1000 gateways.CVE-2026-83549Last month, SonicWall also warned customers that attackers were chaining two new zero-days (CVE-2026-83548 and CVE-2026-83549) in the wild to execute remote code on vulnerable SMA1000 gateways.

People

Ryan DewhurstPrevidian founder and security researcher who told BleepingComputer its honeypot network detected exploitation attempts consistent with CVE-2026-102255.

Malware

OrangeTailFor instance, in July, threat actors abused two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances.RootRunFor instance, in July, threat actors abused two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances.Sou5For instance, in July, threat actors abused two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances.

Vendors

SonicWallMax severity SonicWall SMA1000 flaw now exploited in attacks

Products

CouchDB"The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984.SMA 100 SeriesTracked as CVE-2026-102255, the flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models, but does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls.SMA1000Max severity SonicWall SMA1000 flaw now exploited in attacks

Related Articles