SonicWall SMA 1000: Actively exploited max-severity SSRF in WorkPlace interface allows unauthenticated attackers to reach internal services (CVE-2026-102255)
Severity: critical · Patch status: patched · Since 2026-10-06 · CVE-2026-102255, CVE-2026-15409, CVE-2026-15410
A maximum-severity (CVSS 10.0) server-side request forgery flaw, CVE-2026-102255, in the WorkPlace interface of SonicWall SMA 1000 secure access gateways is under active attack. Disclosed Oct 6, 2026, the flaw stems from an unintended alternate access path letting a remote unauthenticated attacker direct the appliance to issue requests on their behalf, reaching internal functionality and performing unauthorized operations — effectively turning the internet-facing gateway into a proxy to internal services. Honeypot operators Previdian and Defused observed exploitation attempts starting Oct 8-9. SonicWall has released a hotfix; SSL-VPN on SonicWall firewalls and SMA 100 Series are not affected. This follows July zero-day exploitation of two SMA 1000 flaws by the Inc ransomware gang.
What to do
- Apply SonicWall's hotfix for CVE-2026-102255 to all SMA 1000 appliances immediately
- Check appliance logs for unauthenticated SSRF/abnormal WorkPlace traffic since Oct 6 and investigate any anomalies
- Restrict internet exposure of the WorkPlace interface (ACLs, VPN-only access) until patched
- Assess whether internal services could have been reached via the appliance and review those systems for compromise
- Consider migrating away from legacy SSL-VPN/edge appliances toward zero-trust remote access solutions
Fixed versions
- vendor hotfix released (version not stated)
Sources
All live incidents on Threat Watch
