12 OCT 2026 — On 6 October, SonicWall fixed a maximum-severity flaw in its SMA1000 remote-access gateways. Three days later, a security firm's sensors were already seeing attempts to exploit it. The bug, CVE-2026-102255, lets an attacker with no account make the appliance send requests on their behalf to internal functions that should not be reachable.
The researcher who reported the attempts says this is the third flaw of this kind in the same SMA1000 interface this year.
What SonicWall fixed
SonicWall's advisory SNWLID-2026-0017 covers four vulnerabilities in SMA1000 appliances. The serious one is CVE-2026-102255, a server-side request forgery in the Appliance Work Place interface, scored 10.0, the maximum.
Through "an unintended alternate access path", the advisory says, "a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
The other three need a logged-in administrator: a command-injection flaw allowing code execution (7.8), a "Zip Slip" file-extraction flaw in the management console (7.2), and a stored cross-site scripting flaw (5.5).
Which appliances are affected
The flaws affect SMA1000 models 6210, 7210 and 8200v running 12.4.3-03526 or earlier, or 12.5.0-02952 or earlier. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later. SonicWall says there is no workaround, and that neither the SMA 100 series nor the SSL-VPN on its firewalls is affected.
The advisory credits CVE-2026-102255 and the command-injection flaw to Benoît Sevens of Anthropic.
Attempts within three days
SonicWall initially said there was "currently no evidence" any of the four flaws were being exploited. On 9 October Previdian, a security firm that runs honeypots, said its sensors were seeing "exploitation attempts" consistent with CVE-2026-102255, and published the attacking IP address.
Previdian's founder, Ryan Dewhurst, told BleepingComputer that the requests tried to reach an internal CouchDB database service on the appliance using the credentials admin:admin. The firm had not established whether the attempts would have compromised a real system, he said.
As of its 8 October update, the flaw was not in the US Cybersecurity and Infrastructure Security Agency's catalogue of exploited vulnerabilities.
The same interface, again
According to Dewhurst, the flaw sits in the same Work Place interface targeted by server-side request forgery bugs disclosed in July and September, though it uses a different technique. In September SonicWall warned that attackers were chaining two zero-days on SMA1000 gateways.
What administrators should do
These gateways give remote staff access to internal applications, which is why they keep drawing attention. Administrators should install 12.4.3-03670 or 12.5.0-03082, then look for requests that reach internal services from outside, using the address Previdian published.
Disclosure: RECATOOLS is written with the assistance of Claude, made by Anthropic, whose researcher is credited with finding this flaw. Readers should weigh that interest.
View author profile → · Editorial policy
