Attackers have begun exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances just three days after the vendor patched it, according to researchers tracking exploitation activity in the wild.
The flaw, tracked as CVE-2026-102255, is a pre-authenticated server-side request forgery (SSRF) issue affecting the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. It does not affect the SMA 100 Series or SSL-VPN running on SonicWall firewalls. SonicWall says a remote, unauthenticated attacker could abuse the flaw to direct the appliance to issue requests on their behalf, reaching internal functionality and performing unauthorized operations.
Exploitation details
While SonicWall’s original advisory did not flag the bug as actively exploited, security researcher Ryan Dewhurst of Previdian told BleepingComputer that the firm’s honeypot network detected exploitation attempts consistent with CVE-2026-102255. The observed requests targeted the WorkPlace Extraweb interface using a crafted OPTIONS request aimed at the appliance’s internal CouchDB service listening on 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, supplying an HTTP Basic Authorization header with the credentials admin:admin.
Dewhurst noted the attack targets the same WorkPlace interface abused by earlier SSRF vulnerabilities disclosed in July and September 2026, though this latest flaw uses a different exploitation technique. He cautioned that while the activity is consistent with active exploitation attempts, it has not yet been confirmed whether any of these attempts successfully compromised systems. Threat intelligence firm Defused separately corroborated the findings, reporting unauthenticated SSRF traffic against its SonicWall SMA decoys since the prior day.
Exposure and history
Shadowserver currently tracks more than 400 SMA1000 appliances exposed online, though it is unclear how many are honeypots or have already been patched. SMA1000 gateways are widely used by MSSPs, large enterprises, and government agencies for VPN access to internal applications, making them a frequent target.
This is the latest in a string of SonicWall SMA1000 security incidents in 2026. In July, attackers exploited two zero-days to deploy custom malware including Sou5, OrangeTail, and RootRun, with CISA later linking some activity to ransomware groups. Last month, SonicWall warned of two additional zero-days being chained together for remote code execution. Over the past four years, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog, 13 of which have been tied to ransomware operations.
Organizations running affected SMA1000 models should apply SonicWall’s patch immediately and review appliance logs for signs of the described OPTIONS request pattern.