GoKawiilSonicWall SMA1000 SSRF bug CVE-2026-102255 under active attack days after patch
Security researcher Ryan Dewhurst told BleepingComputer that his Previdian honeypots detected exploitation attempts against CVE-2026-102255, a maximum-severity SonicWall SMA1000 vulnerability patched three days earlier. The flaw affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models, letting unauthenticated attackers reach internal functionality via a crafted request to the appliance's internal CouchDB service. Shadowserver counts over 400 SMA1000 appliances still exposed online, though it's unclear how many remain unpatched.