Vulnerabilities

Maximum-Severity SonicWall Flaw Drew Exploit Attempts Within Days

SonicWall’s CVSS 10.0 SMA 1000 bug saw attack traffic on honeypot sensors shortly after disclosure. The vendor had found no in-the-wild abuse. Patch now.

By Content Team

Oct 13, 2026

ON THIS PAGE

SonicWall’s SMA 1000 appliances carry a flaw that scores a perfect 10.0 on CVSS, and attackers began probing for it two days after the fix shipped. CVE-2026-102255 is a pre-authentication server-side request forgery bug in the WorkPlace portal. SonicWall says an unintended access path lets a remote, unauthenticated attacker direct the appliance to issue requests on the attacker’s behalf and reach internal functionality.

The advisory landed on October 6, with SonicWall saying at the time there was no evidence any of its four flaws had been exploited in the wild. Defused logged unauthenticated SSRF traffic against its SMA decoys from October 8, and Previdian reported attempts on its sensors the next day. Benoît Sevens of Anthropic reported the flaw; technical details have not been published.

Upgrade the 6210, 7210 and 8200v to 12.4.3-03670 or 12.5.0-03082. September’s platform hotfixes, 12.4.3-03526 and 12.5.0-02952, are still vulnerable, so patching last month doesn’t cover you. There’s no workaround. SSL-VPN on SonicWall firewalls and the SMA 100 Series are unaffected.

Source: Dark Reading

Have questions about protecting your software?

Our escrow experts are standing by to help.

Book a free demo

Want more insights like this?