135 Probes Hit SonicWall SMA1000 SSRF Flaw CVE-2026-102255 Post-Patch

Threat actors launched 135 exploitation attempts against SonicWall SMA1000 appliances on October 8, 2026, just two days after the vendor released patches for CVE-2026-102255. Security researchers from Previdian and Defused confirmed the activity targeted the critical server-side request forgery flaw, which carries a maximum CVSS score of 10.0. The probes originated from two unique IP addresses located in the United States, according to data from Previdian.

The risk

CVE-2026-102255 allows remote, unauthenticated attackers to force the appliance to issue requests on their behalf. SonicWall stated that this server-side request forgery vulnerability enables access to internal functionality and unauthorized operations. Researchers noted that attackers used crafted OPTIONS requests to reach the internal CouchDB service at 127.0.0.1:5984. The payloads attempted to invoke the _rewrite function within a CouchDB design document while supplying default admin credentials.

Who is exposed

The flaw affects the Appliance WorkPlace interface on SonicWall SMA1000 models 6210, 7210, and 8200v. It does not impact the SMA 100 Series product line or SSL-VPN services running on other SonicWall firewalls. Enterprise-grade secure remote access gateways are frequently targeted because managed service providers, large corporations, and government agencies use them for VPN access to internal applications and corporate networks.

Cost and compliance

SonicWall released patches on October 6, 2026, urging customers to update to software versions 12.5.0-03082 and 12.4.3-03670. Shadowserver currently tracks more than 400 SMA1000 appliances exposed online, though it is unclear how many are honeypots or already patched. SonicWall has not yet updated its original advisory to flag the vulnerability as actively exploited in the wild, despite the confirmed probing activity.

What should you do?

IT teams must verify that all SMA1000 appliances are running the patched software versions 12.5.0-03082 or 12.4.3-03670. Organizations should review firewall logs for OPTIONS requests targeting the WorkPlace interface or internal CouchDB ports. Security operations centers should monitor for connections from the two US-based IP addresses identified by Previdian as sources of the recent exploitation attempts.

Background: Server-side request forgery (SSRF)

Server-side request forgery occurs when your application fetches a URL from an untrusted source without validating it. This lets attackers make your server request internal resources, private cloud data, or other machines, bypassing standard access controls and firewalls.

Read the full guide: Server-Side Request Forgery: How SSRF Bypasses Your Network Defenses

What to do and how to stay safe: SonicWall

• Audit your inventory to ensure every SMA1000 device is updated to the latest patched firmware version provided by SonicWall.
• Inspect web server logs for unusual OPTIONS requests or traffic directed at localhost ports such as 5984, which indicate SSRF exploitation attempts.
• Restrict internet access to the WorkPlace interface to known IP ranges if the appliance is not required for public remote access.
• Monitor for the specific default credentials (admin:admin) in authentication logs, as attackers use these in their initial probing payloads.

Step-by-step guide: Zero-Day Vulnerabilities Meaning: How Unpatched Flaws Bypass Your Defenses

General security guidance from the Vector Tribune newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Which SonicWall SMA1000 models are vulnerable to CVE-2026-102255?

The 6210, 7210, and 8200v models are affected; the SMA 100 Series and SSL-VPN on firewalls are not impacted.

What software versions fix the SSRF vulnerability?

SonicWall released patches in versions 12.5.0-03082 and 12.4.3-03670 on October 6, 2026.

Are these attacks confirmed to have breached systems?

Previdian stated it has not yet established whether the attempts successfully compromised any production systems.