Attackers Exploit SonicWall SMA 1000 SSRF Flaw Days After Disclosure
Unauthenticated attackers are actively exploiting a critical server-side request forgery flaw in SonicWall appliances, shortly after public disclosure.
Key points
- CVE-2026-102255 is a CVSS 10.0 server-side request forgery vulnerability in SonicWall SMA 1000 appliances that requires no authentication.
- Security firms Defused and Previdian have detected active exploitation attempts targeting the flaw since early October 2026.
- SonicWall has released a hotfix via its MySonicWall portal but stated there is no workaround for affected systems.
Attackers are actively exploiting a critical, unauthenticated server-side request forgery vulnerability in SonicWall SMA 1000 appliances, tracked as CVE-2026-102255. This exploitation is occurring just days after the vendor publicly disclosed the flaw.
The vulnerability carries a CVSS score of 10.0, indicating maximum severity. It exists within the SMA 1000 Appliance Work Place interface due to an unintended alternate access path. Remote attackers can abuse this path to direct the appliance to issue requests on their behalf. This allows them to reach internal functionality and perform unauthorized operations without needing to log in.
View the original post on X
View the original post on X
Evidence of Active Exploitation
Multiple cybersecurity researchers have confirmed that the vulnerability is being actively exploited in the wild. Cybersecurity firm Defused reported detecting unauthenticated SSRF traffic targeting its SonicWall SMA decoys starting October 8, 2026. Defused alerted its subscribers to this activity through its Radar service.
Cybersecurity firm Previdian also announced that its sensors detected exploitation attempts consistent with CVE-2026-102255. Previdian researchers recorded 135 attack attempts originating from two different IP addresses located in the United States. One of the reported attacker IP addresses is 146.70.143[.]142.
Despite these reports from third-party firms, SonicWall has not yet updated its security advisory to confirm that attackers are exploiting the flaw. The vendor previously stated it had found no evidence of exploitation, though it recommended applying the available fixes immediately.
Scope and Mitigation
The vulnerability specifically affects SonicWall SMA 1000 appliances. SonicWall clarified that the flaw does not impact SSL-VPN running on its firewalls. Additionally, the SMA 100 Series product line is not affected by this specific vulnerability.
A hotfix for CVE-2026-102255 is available through the MySonicWall portal. The vendor emphasized that there is no workaround for this issue. Administrators must apply the update to secure their systems. No other mitigation steps, such as configuration changes, were provided by the vendor.
What should you do?
Administrators managing SonicWall SMA 1000 appliances should verify their current software version against the vendor’s advisory. Those running affected versions must download and install the hotfix from the MySonicWall portal as soon as possible.
Organizations should monitor their network logs for unusual outbound traffic originating from SMA appliances. Since the flaw allows internal requests, look for connections to unexpected internal services or external command-and-control indicators.
Security teams should review firewall rules to restrict SMA appliance access to trusted management networks only. Limiting exposure reduces the attack surface for unauthenticated remote attackers attempting to exploit the SSRF flaw.
What to do and how to stay safe: SonicWall
- Check if your organization uses SonicWall SMA 1000 appliances and verify the installed software version.
- Apply the hotfix available through the MySonicWall portal immediately if you are running an affected version.
- Monitor network traffic for unusual requests originating from SMA appliances that target internal resources.
- Restrict access to the SMA 1000 management interface to trusted administrative networks only.
Step-by-step guide: Risk Based Vulnerability Management: Prioritize Fixes by Actual Threat
General security guidance from the Threat Times newsroom. It is not confirmed advice from the organisations named in this story.
Frequently asked questions
What is CVE-2026-102255?
It is a critical, unauthenticated server-side request forgery vulnerability in SonicWall SMA 1000 appliances with a CVSS score of 10.0.
Is SonicWall SMA 100 Series affected?
No, SonicWall stated that the SMA 100 Series product line and SSL-VPN on its firewalls are not impacted by this flaw.
Has SonicWall confirmed active exploitation?
No, SonicWall has not updated its advisory to confirm exploitation, though third-party firms like Defused and Previdian have detected attacks.
