SonicWall SMA1000 SSRF drew exploitation probes two days after patch release

What SonicWall disclosed

SonicWall published advisory SNWLID-2026-0017 on 6 October 2026, covering four vulnerabilities in its SMA1000 line — edge appliances that broker external access to internal systems for staff and partners.

The headline entry is CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) in the Work Place interface rated CVSS v3 10.0. SonicWall labels it both an SSRF and an unintended-proxy flaw, essentially a confused-deputy problem in which the appliance is fooled into forwarding requests on an attacker's behalf. The advisory lists no workaround.

Three further issues carry lower scores and demand more from the attacker: CVE-2026-102256, a post-authentication OS command injection rated 7.8; CVE-2026-102257, a Zip Slip path traversal in the Appliance Management Console rated 7.2 that can escalate to remote code execution; and CVE-2026-102258, a stored cross-site scripting flaw rated 5.5. Benoît Sevens of Anthropic is credited with the first two; Brian Mariani, via the Zero Day Initiative and DigitalCanion, with the others.

Affected models are the 6210, 7210 and 8200v on platform hotfix 12.4.3-03526 or older, or 12.5.0-02952 or older. Fixed builds are 12.4.3-03670 and 12.5.0-03082 and higher, distributed through MySonicWall. SonicWall says the SSL-VPN feature on its firewall products is not affected, and Help Net Security reports the SMA 100 series is likewise in the clear.

The third round on the same interface

The Work Place interface has now forced urgent patching three times in a single year. Beazley Security notes that threat actors exploited earlier SSRF flaws in this same interface as zero-days, disclosed by SonicWall in July and again in September 2026. The September round covered CVE-2026-83548, a pre-authentication SSRF, and CVE-2026-83549, a post-authentication OS command injection; CISA placed both in its Known Exploited Vulnerabilities catalogue on 2 September, and attackers combined the pair to achieve unauthenticated remote code execution. Help Net Security identifies the two zero-day SSRFs of 2026 as CVE-2026-15409 and CVE-2026-83548.

The consequence for administrators is blunt: anyone who applied the September hotfix, 12.5.0-02952, is now on a build the new advisory flags as affected and must upgrade again within weeks. Beazley also observes that SonicWall's description of the new flaw closely mirrors its wording for CVE-2026-83548, and the vendor has not clarified whether this is a variant of the earlier bug or a bypass of its fix. No proof-of-concept or technical write-up exists beyond the advisory text, so defenders cannot reason about exploitation mechanics from public material.

Two days from disclosure to probes

SecurityWeek reports that SonicWall disclosed the vulnerability on 6 October and that threat intelligence firms Previdian, formerly KEVIntel, and Defused raised the alarm over initial exploitation attempts by the end of that week. Defused said its SMA decoys logged the first attempts on 8 October, two days after disclosure. Horizon3.ai cautioned that successful exploitation could allow attackers to take over vulnerable devices.

The accounts conflict on timing. SonicWall's advisory states there is currently no evidence of in-the-wild exploitation, but that text was last updated on 6 October — two days before the decoy hits — and a capture of the page on 13 October still carried that date. Beazley updated its own advisory on 9 October to record that researchers had publicly reported exploitation attempts. Help Net Security adds that no attempt has been confirmed successful against a real deployment; a probe wave is evidence of attacker interest, warranting log review and reduced exposure rather than an assumption of breach.

What the captured payload reveals

Beazley published the payload its research honeypots recorded: an OPTIONS request directed at a local service listening on port 5984, CouchDB's default port — an inference, since Beazley does not name the service — embedded in a path-traversal sequence and arriving with a Safari user agent and an Origin header. A request aimed at localhost shows what kind of internal service the attacker presumes is reachable through the appliance.

Why it matters

A remote access appliance occupies a privileged position: it terminates external sessions and stores or mediates the credentials of everyone passing through it. An SSRF there pushes attacker traffic past the boundary the appliance exists to guard, exposing internal services that were never built for untrusted input. With a CVSS 10.0 rating, a two-day gap between disclosure and the first recorded probes, and a third patch cycle on the same portal inside a year, the action is straightforward: move to 12.4.3-03670 or 12.5.0-03082 promptly — particularly if the September hotfix was applied only weeks ago — and treat the Work Place interface's external exposure itself as the asset that deserves scrutiny. The evidence says there is no quiet window after an advisory lands.