A critical SonicWall SMA 1000 flaw is now being targeted in active exploitation attempts only days after patches were released.
The vulnerability, tracked as CVE-2026-102255, carries a maximum CVSS score of 10.0 and affects the WorkPlace interface in SonicWall Secure Mobile Access 1000 appliances.
According to SonicWall’s official security advisory, the flaw is a pre-authentication server-side request forgery vulnerability caused by an unintended alternate access path.
A remote attacker does not need valid credentials to reach the vulnerable path. By abusing it, an attacker may be able to force the appliance to issue requests on their behalf, reach internal functionality and perform unauthorized operations.
SonicWall released fixed builds on October 6, 2026, but independent threat-monitoring sensors began observing exploitation attempts shortly afterward.
What Is CVE-2026-102255?
CVE-2026-102255 is a server-side request forgery, or SSRF, vulnerability affecting the WorkPlace interface of SonicWall SMA 1000 appliances.
The flaw exists because an unintended alternate access path can be reached before authentication.
This matters because SMA appliances often sit at the edge of enterprise networks and provide remote users with access to internal applications and services.
An attacker who can abuse the flaw may be able to make the device communicate with internal services that are not normally reachable from the internet.
The official CVE record describes the issue as a pre-authentication SSRF vulnerability and confirms a CVSS score of 10.0.
135 Exploitation Attempts Observed
Independent threat-intelligence provider Previdian has reported sensor-observed exploitation activity targeting CVE-2026-102255.
Its telemetry recorded 135 exploitation attempts from two attacker IP addresses, with the activity first appearing shortly after the vulnerability was disclosed.
The attempts were observed against honeypot and sensor infrastructure designed to identify exploit activity in the wild.
This is an important distinction: sensor telemetry shows that attackers are actively probing or attempting to exploit the vulnerability, but it does not automatically prove that every attempt resulted in a successful compromise.
SonicWall’s advisory, meanwhile, still states that the company has no evidence that the newly disclosed vulnerabilities covered by the October advisory are being exploited in the wild.
That creates a difference between the vendor’s current official position and independent exploitation telemetry.
Which SonicWall SMA 1000 Versions Are Affected?
SonicWall says the vulnerabilities affect SMA 1000 models 6210, 7210 and 8200v running affected 12.4.3 and 12.5.0 platform-hotfix versions.
The affected and fixed versions are:
- 12.4.3-03526 and older — affected
- 12.4.3-03670 and later — fixed
- 12.5.0-02952 and older — affected
- 12.5.0-03082 and later — fixed
SonicWall recommends that all organizations running affected SMA 1000 appliances upgrade to the latest available hotfix.
SMA 100 Series and Firewall SSL-VPN Are Not Affected
The vulnerability does not affect every SonicWall remote-access product.
The affected product family is the SMA 1000 Series, including the 6210, 7210 and 8200v models.
The separate SMA 100 Series and SSL-VPN functionality running on SonicWall firewalls are not listed as affected by CVE-2026-102255.
Administrators should therefore verify the exact product model and firmware version before assessing exposure.
Three Other Vulnerabilities Were Patched at the Same Time
CVE-2026-102255 was disclosed alongside three additional vulnerabilities affecting SMA 1000 appliances.
- CVE-2026-102256 — OS command injection that could lead to remote code execution under specific conditions, rated CVSS 7.8
- CVE-2026-102257 — Zip Slip path traversal issue that could lead to remote code execution, rated CVSS 7.2
- CVE-2026-102258 — stored cross-site scripting vulnerability, rated CVSS 5.5
Unlike CVE-2026-102255, the other flaws require authenticated access or higher privileges.
SonicWall has not publicly said that CVE-2026-102255 can be chained with these three vulnerabilities to achieve remote code execution.
Why a Pre-Authentication SSRF on a VPN Appliance Is Serious
Edge devices such as VPN gateways are attractive targets because they are exposed directly to the internet while also maintaining trusted connections to internal enterprise systems.
An SSRF vulnerability in that position can potentially allow an attacker to reach services that are intended to remain accessible only from inside the appliance or internal network.
If attackers can turn a VPN gateway into a proxy for internal requests, the device can become a stepping stone into more sensitive infrastructure.
This is why pre-authentication vulnerabilities on security appliances typically receive urgent attention even before confirmed compromise reports become available.
SonicWall SMA 1000 Has Faced Multiple Attacks in 2026
The latest flaw comes after several other serious vulnerabilities affected the SMA 1000 platform earlier in 2026.
In September, SonicWall disclosed CVE-2026-83548 and CVE-2026-83549, a pre-authentication SSRF flaw and a post-authentication command-injection issue.
SonicWall confirmed that those vulnerabilities had been actively exploited in the wild and advised customers to upgrade, review systems for indicators of compromise and take additional recovery actions if compromise was detected.
The earlier September advisory is available through SonicWall’s official support portal.
Earlier SMA 1000 Exploitation Led to Credential Theft and Persistence
Earlier attacks against SMA 1000 appliances show why defenders should treat internet-facing VPN vulnerabilities seriously.
Previous exploitation involving different SonicWall SMA vulnerabilities was used to establish persistent access, execute commands and move deeper into corporate networks.
Attackers were also observed targeting valuable authentication material, including active session information, credentials and time-based one-time password data.
Those earlier incidents involved separate vulnerabilities and should not be treated as proof that CVE-2026-102255 is currently being used in the same way.
However, they demonstrate the potential impact when attackers successfully compromise a remote-access appliance positioned at the enterprise perimeter.
Should Administrators Wait for Vendor Confirmation of Exploitation?
No.
The combination of a CVSS 10.0 severity rating, pre-authentication exposure and sensor-observed exploit attempts creates enough risk to justify immediate patching.
Organizations do not need to wait for a confirmed compromise before updating an exposed security appliance.
SonicWall explicitly recommends upgrading all affected SMA 1000 deployments to the latest hotfix versions.
What SonicWall Administrators Should Do Now
Organizations using SMA 1000 appliances should first identify whether they are running an affected build.
Administrators should:
- Upgrade SMA 1000 appliances to the latest fixed platform hotfix
- Confirm that all internet-facing appliances are included in the update process
- Review logs for suspicious access to the WorkPlace interface
- Monitor unexpected internal requests originating from the appliance
- Investigate unusual authentication activity
- Review administrator and privileged accounts
- Check for unexplained configuration or system changes
- Maintain backups and recovery procedures for edge appliances
Organizations that suspect compromise should escalate to incident response rather than treating the issue as a routine patching task.
Why Edge Device Vulnerabilities Keep Becoming High-Priority Targets
VPN appliances, firewalls and remote-access gateways are valuable targets because successful compromise can bypass controls that protect ordinary endpoints.
These devices frequently have broad network visibility and can handle authentication sessions for remote users.
When a vulnerability is reachable before authentication, attackers can begin probing exposed systems without first obtaining valid credentials.
This has made edge-device vulnerabilities an increasingly important part of enterprise vulnerability management.
For more coverage of actively exploited vulnerabilities and remediation priorities, see our CVE and Vulnerability Exploits 2026 Hub.
Frequently Asked Questions
What is CVE-2026-102255?
CVE-2026-102255 is a critical pre-authentication server-side request forgery vulnerability in the WorkPlace interface of SonicWall SMA 1000 appliances. It carries a CVSS score of 10.0.
Is CVE-2026-102255 being exploited?
Independent sensor telemetry has observed exploitation attempts targeting the vulnerability. Previdian recorded 135 attempts from two attacker IP addresses. SonicWall’s current advisory, however, still says the company has no evidence that the vulnerabilities in its October advisory are being exploited in the wild.
Which SonicWall devices are affected?
The affected products are SonicWall SMA 1000 models 6210, 7210 and 8200v running vulnerable 12.4.3 or 12.5.0 platform-hotfix versions.
Which versions fix the vulnerability?
SonicWall says customers should update to version 12.4.3-03670 or later, or version 12.5.0-03082 or later.
Does the flaw affect SonicWall firewalls?
The advisory applies to SMA 1000 Series appliances. SonicWall’s separate firewall SSL-VPN functionality and SMA 100 Series are not listed as affected by CVE-2026-102255.
Final Thoughts
CVE-2026-102255 combines several characteristics defenders should take seriously: maximum severity, pre-authentication exposure, internet-facing infrastructure and early signs of exploitation activity.
SonicWall has already released hotfixes, which means organizations running vulnerable SMA 1000 builds have a clear remediation path.
Independent telemetry suggests attackers are already testing the vulnerability, even though SonicWall’s advisory has not yet been updated to confirm active exploitation.
For organizations using affected SMA 1000 appliances, the safest response is to patch immediately and review exposed systems for suspicious activity rather than waiting for broader confirmation of successful attacks.
