CVE-2026-102255: SonicWall SMA1000 vulnerability, third SSRF of 2026

The SonicWall SMA1000 vulnerability patched on October 6, CVE-2026-102255, is a pre-authentication server-side request forgery in the WorkPlace portal, rated CVSS 10.0, and by October 9 two honeypot operators were catching attempts to exploit it. It affects SMA 6210, 7210 and 8200v appliances on 12.4.3-03526 or 12.5.0-02952 and older, which includes the exact builds SonicWall told you to install in September. If you run an SMA1000 with WorkPlace reachable from the internet, install 12.4.3-03670 or 12.5.0-03082 this week and check the logs for the patterns below.

What happened

This is the third unauthenticated WorkPlace SSRF SonicWall has fixed this year, and both earlier ones were exploited as zero-days, before a patch existed. That history is why we would not wait for a KEV listing on this one.

• July 14, 2026: SNWLID-2026-0008 fixed CVE-2026-15409 (SSRF, CVSS 10.0) and CVE-2026-15410, with SonicWall reporting “multiple cases” of active exploitation. CISA added both to KEV the same day and later marked them as used in ransomware campaigns.
• September 1, 2026: SNWLID-2026-0016 fixed CVE-2026-83548 (another WorkPlace SSRF) and CVE-2026-83549 after SonicWall investigated “a case indicating the active exploitation”. KEV followed on September 2.
• October 6, 2026: SNWLID-2026-0017 fixed CVE-2026-102255 and three post-authentication bugs, stating there was “currently no evidence” of exploitation.
• October 7, 2026: NVD published the record. CISA’s SSVC assessment that day read exploitation “none”, automatable “yes”, technical impact “total”.
• October 9, 2026: Previdian and Defused told BleepingComputer their decoys were receiving unauthenticated SSRF traffic consistent with the new flaw.

As of October 12 the CVE is not in the KEV catalog, and SonicWall’s advisory has not been updated since October 6.

Which SMA1000 build is safe now

Each SonicWall bulletin this year moved the fix line forward, and each new bulletin listed the previous fix build as affected. Plan against the right-hand column only.

Branch	July 14 fix (15409)	Sept 1 fix (83548)	Oct 6 fix (102255)
12.4.3 (platform-hotfix)	12.4.3-03453	12.4.3-03526	12.4.3-03670
12.5.0 (platform-hotfix)	12.5.0-02835	12.5.0-02952	12.5.0-03082

The version trap sits in the middle column. A team that patched promptly for the September zero-days is running 12.4.3-03526 or 12.5.0-02952, and SonicWall lists both as affected by CVE-2026-102255. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected. The same hotfix also closes CVE-2026-102256 (command injection, CVSS 7.8), CVE-2026-102257 (Zip Slip in the management console, 7.2) and CVE-2026-102258 (stored XSS, 5.5), all of which need an authenticated administrator.

How the SMA1000 SSRF works

SonicWall describes CVE-2026-102255 as an SSRF “via unintended forward-proxy”. An unauthenticated attacker can make the appliance “issue requests on their behalf and reach internal functionality and perform unauthorized operations”, and the advisory does not say which functions. That vagueness is the reason to look at the July bug, because it shows what lives behind the WorkPlace front door.

Rapid7’s analysis of CVE-2026-15409 found a websocket proxy at /wsproxy that opened a TCP tunnel to any host and port named in the URL. Pointed at localhost, it reached services that were never meant to face the internet, including an Erlang process on port 1050 and the ctrl-service on 8188. Rapid7’s proof of concept ran commands as the couchdb user, and the second bug, CVE-2026-15410, took that to root. Attackers in the wild then took credentials, session databases and TOTP seeds from the box.

The October traffic aims at the same neighbourhood by a different route. Previdian founder Ryan Dewhurst described crafted OPTIONS requests to the WorkPlace Extraweb interface that tried to reach the internal CouchDB service at 127.0.0.1:5984, traverse into a design document and call its _rewrite handler, with an HTTP Basic header carrying admin:admin. Previdian has not established whether those attempts would have compromised anything, and Field Effect notes that nothing public yet shows code execution through 102255 alone. So someone has already built a working SSRF probe, while the question of what it can reach stays open. We would treat an exposed, unpatched SMA1000 as a box to hunt on, not only to patch.

How to detect SMA1000 exploitation attempts

Most of the evidence sits in the appliance’s own web access log, which is why forwarding it matters more than any rule. Rapid7’s July indicators match on the method, the request path, its query string and the status code in extraweb_access.log, so that log already holds what you need. The rule below covers both the October probe pattern and the July tunnel, and it maps to ATT&CK T1190.

Data source: SMA1000 extraweb_access.log forwarded by syslog to your SIEM (or the access logs of a reverse proxy in front of WorkPlace)

title: SonicWall SMA1000 WorkPlace SSRF to Appliance-Local Services
id: 3c8e7a52-1f6d-4b9e-a0d4-6b2f9c71e8a4
status: experimental
description: Detects WorkPlace requests that try to reach appliance-local services, as in CVE-2026-102255 probe traffic (CouchDB on 5984) and the CVE-2026-15409 wsproxy tunnel.
references:
    - https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
    - https://www.rapid7.com/blog/post/etr-rapid7-mdr-team-discovers-new-sonicwall-sma1000-zero-days-being-actively-exploited-cve-2026-15409-cve-2026-15410
author: MarkCyber Research
date: 2026-10-12
tags:
    - attack.initial-access
    - attack.t1190
    - cve.2026-102255
    - cve.2026-15409
logsource:
    category: webserver
detection:
    selection_couchdb_method:
        cs-method: 'OPTIONS'
    selection_couchdb_target:
        - cs-uri-stem|contains:
              - ':5984'
              - '_rewrite'
              - '_design'
        - cs-uri-query|contains:
              - ':5984'
              - '_rewrite'
              - '_design'
    selection_wsproxy:
        cs-uri-stem|contains: '/wsproxy'
        cs-uri-query|contains:
            - 'host=localhost'
            - 'host=127.'
            - 'host=0.0.0.0'
            - '127.0.0.1'
        sc-status: 101
    condition: (selection_couchdb_method and selection_couchdb_target) or selection_wsproxy
falsepositives:
    - Vulnerability scanners and your own patch validation; check the source address against scanner ranges
level: high

The rule only matches when the payload sits in the request line. Previdian has not published the raw request, so if the CouchDB address travels in a header your log does not keep, this rule stays quiet. Our advice is to run it, then also read every OPTIONS request to WorkPlace since October 6 by eye, because the payload layout is not public and a person reading the lines catches variants that a string match misses. Investigate back to at least July 1, since the July chain was exploited before disclosure.

A quiet log does not clear the appliance, so finish with the July artifacts that Rapid7 published:

• Windows Event ID 4624, logon type 3, on domain controllers where the source is the appliance’s internal IP and the workstation name is not in your inventory. Rapid7 saw kali and DESKTOP- names under the appliance’s LDAP service account, with no VPN session behind them. This is T1078 and the step that turns an appliance bug into a domain problem.
• /var/lib/unit/conf.json holding routes for /__api__/login or /__api__/logout, which Rapid7 says legitimate configurations do not contain.
• Access to /tmp/temp.db*, consistent with theft of session data.

Mitigation

1. Upgrade every 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082 or later from MySonicWall, per SonicWall’s October 6 advisory. There is no workaround, and the appliance restarts when the hotfix finishes, so schedule the window.
2. Before patching, pull extraweb_access.log off the box so the hunt above has data to work with.
3. If you find indicators, follow the recovery steps SonicWall gave for the September attacks: re-image hardware or redeploy virtual appliances, change all user and administrator passwords, and reset TOTP tokens. Rotate the LDAP service account too, given what Rapid7 saw it used for.

Edge appliances like this one run no EDR, so the SOC only sees what their logs say. Three SMA1000 advisories in three months is a good argument for getting those logs into the SIEM permanently, and it is the kind of security engineering work we do. We covered the same patch-then-patch-again pattern on Citrix NetScaler on October 11.

Bottom line

Move every SMA1000 to 12.4.3-03670 or 12.5.0-03082 now, including appliances you patched in September. Then search WorkPlace logs back to July 1 for the probe and tunnel patterns above, and check your domain controllers for logons from the appliance itself.