SonicWall SMA 1000 SSRF flaw: Active US attacks emerged two days after patch despite vendor's no-exploit claim
Security firms detected active exploitation of a critical, unauthenticated flaw in SonicWall appliances shortly after the vendor issued a fix.
Key points
- CVE-2026-102255 is a server-side request forgery flaw rated 10.0 that requires no authentication.
- Threat intelligence firms detected attack traffic beginning on October 8, 2026, from US-based IP addresses.
- SonicWall released a hotfix on October 6, 2026, but stated no evidence of wild exploitation existed at that time.
Threat intelligence organizations detected active exploitation of a critical server-side request forgery vulnerability in SonicWall SMA 1000 appliances just days after the vendor published a security update. The flaw, identified as CVE-2026-102255, carries a CVSS score of 10.0 and allows remote attackers to operate without any login credentials.
According to Security Affairs, attackers began abusing the vulnerability immediately after its public disclosure. The issue resides in the SMA 1000 Work Place interface and involves an unintended alternate access path. This design flaw permits a remote, unauthenticated attacker to direct the appliance to issue requests on their behalf, potentially reaching internal functions and performing unauthorized operations.
View the original post on X
View the original post on X
Attack Timeline and Detection
Defused Cyber reported receiving suspicious traffic targeting its SonicWall SMA decoys starting October 8, 2026. This activity began two days after SonicWall released the fix for the vulnerability. Defused alerted its subscribers via the Radar service regarding the unauthenticated SSRF traffic. The rapid onset of attacks suggests that automated scanning or targeted exploitation began almost immediately after the vulnerability became known to the public.
Previdian also confirmed detection of exploitation attempts consistent with CVE-2026-102255. According to Cyber Security News, Previdian researchers recorded 135 attack attempts originating from two distinct IP addresses located in the United States. One reported attacker IP address is 146.70.143[.]142. These figures represent activity observed by monitoring sensors, not confirmed compromises of customer networks.
Scope and Affected Systems
The vulnerability specifically affects SonicWall Secure Mobile Access SMA 1000 appliances used for remote access to business resources. SonicWall clarified that the flaw does not impact SSL-VPN services running on SonicWall firewalls or the SMA 100 Series product line. The vendor published advisory SNWLID-2026-0017 on October 6, 2026, addressing this SSRF flaw along with three other vulnerabilities.
The advisory also covers CVE-2026-102256, a command injection flaw allowing code execution after authentication; CVE-2026-102257, a Zip Slip issue enabling file extraction outside intended directories; and CVE-2026-102258, allowing stored JavaScript execution in the management console. However, the unauthenticated SSRF flaw remains the most severe due to its lack of access requirements.
Our take on the response
SonicWall stated in its initial advisory that there was no evidence of exploitation in the wild at the time of disclosure. The subsequent detection of attacks by Defused and Previdian indicates that threat actors moved quickly to target the flaw. The absence of a workaround, as noted by the vendor, makes applying the available hotfix the only effective defensive measure for affected systems.
Background: CVSS score
The Common Vulnerability Scoring System (CVSS) assigns a numerical score from 0.0 to 10.0 to software vulnerabilities. It calculates this number by weighing factors like attack complexity, required privileges, and impact on confidentiality, integrity, and availability. You use the score to compare the severity of different flaws, but you must adjust for your own context to prioritize fixes correctly.
Read the full guide: How CVSS Scores Work: The Math Behind Vulnerability Ratings
What to do and how to stay safe: SonicWall
- Verify if your organization uses SonicWall SMA 1000 appliances and check their current software version against the vendor's advisory.
- Install the latest hotfix available through the MySonicWall portal to patch CVE-2026-102255 and the associated vulnerabilities.
- Monitor network logs for unauthenticated requests originating from external IP addresses targeting the SMA 1000 Work Place interface.
- Review firewall rules to restrict access to the SMA 1000 management interface from untrusted networks while awaiting confirmation of patch deployment.
Step-by-step guide: Vulnerability Prioritization for Small Businesses
General security guidance from the DataSafe Radar newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102255?
It is a server-side request forgery (SSRF) vulnerability in SonicWall SMA 1000 appliances that allows unauthenticated attackers to make the device send requests to internal functions.
Are SonicWall firewalls affected by this SSRF flaw?
No, the vulnerability does not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line, according to the vendor.
Has SonicWall confirmed widespread exploitation?
SonicWall stated there was no evidence of exploitation when the advisory was published, but threat firms have since detected active attack attempts.
