SonicWall shipped fixes on October 6 for CVE-2026-102255, a pre-authentication server-side request forgery (SSRF) vulnerability in the SMA 1000 Appliance WorkPlace interface, scored a maximum CVSS 10.0.

According to The Hacker News and eSecurity Planet, threat intelligence firms Defused Cyber and Previdian detected the first exploitation attempts on October 8.

By October 12, The Hacker News reports Previdian had logged 135 exploitation attempts, all from two unique IP addresses located in the United States. The researchers have not established whether any attempt successfully compromised a system, and no successful compromises have been confirmed.

The flaw needs no credentials: an unauthenticated remote attacker can make the appliance issue requests to internal services and perform unauthorized operations, inheriting the device's network vantage point into admin panels, cloud metadata endpoints, and patch servers. eSecurity Planet reports that, per BleepingComputer, Previdian founder Ryan Dewhurst said honeypots detected specially crafted HTTP requests targeting the WorkPlace Extraweb interface, attempting to reach an internal CouchDB service through the vulnerable appliance.

SonicWall's advisory still states the company has no evidence of exploitation in the wild, but the Canadian Centre for Cyber Security updated its alert on October 9 to acknowledge public reports of exploitation.

This is not the first time SMA 1000 appliances have drawn this attention.

In June 2026, a threat actor tracked as UTA0533 weaponized two other flaws in the same product as zero-days — CVE-2026-15409, another CVSS 10.0, and CVE-2026-15410, scored 7.2 — deploying Java web shells and malware called KNUCKLEBALL.

According to the account published via The Hacker News, the actor then pulled credentials, active session databases, and TOTP seed configurations used for MFA off the compromised boxes, decrypted one-time codes at will, and moved laterally into corporate networks.

The current activity — two IP addresses and a modest attempt count — suggests reconnaissance or early-stage exploitation rather than a settled foothold, but the June campaign shows exactly what attackers want from these devices.

The flaw affects physical and virtual deployments of SMA 1000 models 6210, 7210, and 8200v running firmware 12.4.3-03526 and earlier or 12.5.0-02952 and earlier; fixed versions are 12.4.3-03670 and 12.5.0-03082. The SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.

If patching takes time, defenders should block inbound management traffic from untrusted networks, restrict the appliance's outbound reach so SSRF requests cannot hit internal services, and review firewall rules toward metadata endpoints.

Admins should also force session re-authentication, rotate credentials reachable through the appliance, and reset TOTP seeds for any account whose seed could have left the box — each one a door the June actors already knew how to open.