GoKawiilAttackers exploit maximum-severity SSRF flaw in SonicWall SMA 1000 appliances
SonicWall disclosed CVE-2026-102255, a 10/10 CVSS SSRF vulnerability in the WorkPlace interface of its SMA 1000 secure access gateway, caused by an unintended alternate access path that lets unauthenticated attackers issue requests on the appliance's behalf. Days after the Oct. 6 advisory, security firms Previdian and Defused reported seeing exploitation attempts against this flaw on their honeypot sensors, though SonicWall says it has no evidence of in-the-wild exploitation.
GoKawiil's interpretation of the reporting above, not reported fact.
The gap between vendor and third-party claims highlights how detection timelines can differ, and organizations running exposed SMA WorkPlace portals may be at risk before official confirmation arrives. Because the flaw allows unauthenticated access to internal functionality, successful exploitation could let attackers pivot into internal networks, making rapid patching and monitoring critical even absent confirmed compromise.
- CVE-2026-102255 is a maximum-severity SSRF bug in SonicWall SMA 1000's WorkPlace interface.
- Security vendors Previdian and Defused reported exploitation attempts on honeypots starting around Oct. 8-9.
- SonicWall maintains it has no evidence of real-world exploitation of this or three other disclosed CVEs.
Source: darkreading.com — Rob Wright, 2026-10-12
Published there as: “Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack”
Read the original report → The summary and analysis above are GoKawiil's own, written from reporting by the source above. Facts and quotes belong to the original publisher.