Cve 2026 102255 - GoKawiil

SonicWall SMA1000 SSRF bug CVE-2026-102255 under active attack days after patch

Security researcher Ryan Dewhurst told BleepingComputer that his Previdian honeypots detected exploitation attempts against CVE-2026-102255, a maximum-severity SonicWall SMA1000 vulnerability patched three days earlier. The flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models, letting unauthenticated attackers reach internal functionality via a crafted request to the appliance's internal CouchDB service. Shadowserver counts over 400 SMA1000 appliances still exposed online, though it's unclear how many remain unpatched.

bleepingcomputer.com · 2026-10-09

SonicWall patches critical SSRF bug in SMA1000 remote-access gateways

SonicWall issued hotfixes for CVE-2026-102255, a maximum-severity server-side request forgery flaw in the Appliance WorkPlace interface of its SMA1000 6210, 7210, and 8200v gateways. The company says an unauthenticated attacker could exploit the flaw via an unintended access path to make the appliance issue requests on their behalf and reach internal functionality, though it has found no evidence of active exploitation.

bleepingcomputer.com · 2026-10-07