Key points
- CVE-2026-102255 affects SMA1000 6210, 7210, and 8200v models via the WorkPlace interface.
- Threat intelligence firms Previdian and Defused detected exploitation attempts shortly after the patch release.
- The flaw allows unauthenticated attackers to direct appliances to access internal services like CouchDB.
Security researchers have observed active exploitation attempts against SonicWall SMA1000 appliances running vulnerable software versions. The attacks target CVE-2026-102255, a maximum-severity server-side request forgery flaw in the WorkPlace interface. According to BleepingComputer, these attempts emerged just days after SonicWall released a patch on Tuesday. The vulnerability carries a CVSS score of 10.0, indicating severe risk to affected systems.
In plain English
The flaw allows an attacker without any login credentials to trick the appliance into making requests on their behalf. This technique is known as server-side request forgery. By abusing this path, attackers can reach internal functionality that should be hidden from the outside world. SonicWall stated that this could enable unauthorized operations on the device. The specific attack vector involves crafting requests to access internal services, such as the CouchDB database running on the appliance itself.
The background
SonicWall disclosed CVE-2026-102255 on 6 October, urging customers to update their 6210, 7210, and 8200v models to specific software versions. The flaw does not affect the SMA 100 Series product line or SSL-VPN running on SonicWall firewalls. According to SecurityWeek, threat intelligence firms Previdian and Defused confirmed the first exploitation attempts reached their decoys on 8 October. This was only two days after public disclosure of the vulnerability.
What changes now
Previdian founder Ryan Dewhurst told BleepingComputer that the requests targeted the WorkPlace Extraweb interface using crafted OPTIONS requests. These attempts aimed to reach the internal CouchDB service at 127.0.0.1:5984. The payload tried to invoke a rewrite function with default credentials. While Defused confirmed unauthenticated SSRF traffic against their SonicWall SMA decoys, it remains unclear if any real systems were successfully compromised. Shadowserver tracks over 400 exposed SMA1000 appliances online.
What to do and how to stay safe: SonicWall
- Verify that all SMA1000 6210, 7210, and 8200v appliances are updated to versions 12.5.0-03082 or 12.4.3-03670 immediately.
- Monitor network logs for unusual OPTIONS requests targeting the WorkPlace interface or internal IP ranges.
- Ensure that administrative interfaces are not directly accessible from the internet without additional access controls.
- Review firewall rules to block unnecessary traffic to the appliance’s management ports until patches are confirmed.
Step-by-step guide: Emergency Patching: Correcting Five Common Operational Errors
General security guidance from the RedTeam Log newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
Which SonicWall models are affected by CVE-2026-102255?
The vulnerability affects SMA1000 6210, 7210, and 8200v models, but not the SMA 100 Series or SSL-VPN on firewalls.
Is there a patch available for this vulnerability?
Yes, SonicWall released a patch on Tuesday, urging updates to software versions 12.5.0-03082 and 12.4.3-03670.
Are these attacks confirmed to have succeeded?
No, Previdian has not established whether the observed attempts successfully compromised any real systems.
