A critical vulnerability CVE-2026-102255 — unauthenticated server-side request forgery (SSRF) — has been discovered in SonicWall SMA 1000 appliances. According to the original report, the vulnerability has been assigned a CVSS score of 10.0, although this rating could not be independently confirmed via a vendor advisory or NVD at the time of publication. SonicWall released patches on October 6, 2026, but reports of exploitation attempts appeared just two days later. Organizations using SMA 1000 must install the updates immediately — this is already the third critical vulnerability in this product line in 2026, and the previous ones were actively used by attackers to penetrate corporate networks.
Technical details of the vulnerability
CVE-2026-102255 belongs to the SSRF (Server-Side Request Forgery) class of vulnerabilities. Exploitation allows a remote, unauthenticated attacker to force the device to make requests on their behalf, gaining access to internal functionality and performing unauthorized operations. According to the original report, SonicWall has published security advisory SNWLID-2026-0017 and released two fixes:
- Version 12.4.3-03670 (platform-hotfix)
- Version 12.5.0-03082 (platform-hotfix)
It is important to stress that the specific version numbers and the CVSS 10.0 score are confirmed only by the original news report. It is recommended to verify the applicable updates directly against the SonicWall advisory.
Exploitation status
The original report cites data from Defused Cyber and Previdian, which recorded attempts to exploit CVE-2026-102255 starting October 8, 2026. There were reportedly 135 attempts from two IP addresses located in the United States. However, this data has not received independent confirmation: neither SonicWall nor CISA nor major research companies have so far confirmed active exploitation. CVE-2026-102255 has not been added to the CISA KEV (Known Exploited Vulnerabilities) catalog, unlike the two previous vulnerabilities in the same product. Thus, at this point it is more accurate to speak of observed scanning attempts rather than confirmed compromises.
Context: previous attacks on SMA 1000
CVE-2026-102255 is not an isolated incident. Earlier in 2026, two other vulnerabilities in SonicWall SMA 1000 were actively exploited as zero-day vulnerabilities:
- CVE-2026-15409 (CVSS 10.0) — a critical SSRF vulnerability that allows an unauthenticated attacker to open a WebSocket-based tunnel to services accessible only on localhost.
- CVE-2026-15410 (CVSS 7.2) — a code injection vulnerability that enables command execution with root privileges via the remove_hotfix mechanism.
Both vulnerabilities were discovered by the Rapid7 MDR team and were added to the CISA KEV catalog on July 14, 2026, with a remediation deadline of July 17. We have already written about the exploitation of these vulnerabilities earlier.
According to Rapid7, after compromising a device through the CVE-2026-15409 + CVE-2026-15410 chain, attackers systematically extracted credentials, databases of active sessions, and TOTP seed configurations for multi-factor authentication. This was followed by lateral movement — the attackers moved from the compromised device directly into the internal corporate network, including anomalous authentications to Active Directory without using VPN.
This context is critical: CVE-2026-102255, as another unauthenticated SSRF vulnerability in the same product, potentially opens similar attack vectors. SMA 1000 appliances have already proven to be a priority target for threat actors seeking stealthy initial access to corporate networks.
Affected products and versions
CVE-2026-102255 affects SonicWall SMA 1000 series appliances. According to Rapid7, the affected models in the context of the previous vulnerabilities are SMA 6210, 7210, and 8200v. For CVE-2026-15409 and CVE-2026-15410, the vulnerable firmware versions were:
- 12.4.3-03245, 12.4.3-03387, 12.4.3-03434
- 12.5.0-02283, 12.5.0-02624, 12.5.0-02800
The fixed versions for the previous vulnerabilities were 12.4.3-03453 and 12.5.0-02835 respectively. CVE-2026-102255 requires newer versions: 12.4.3-03670 and 12.5.0-03082. There are no workarounds to mitigate these vulnerabilities without updating.
Recommendations
Immediate update: install versions 12.4.3-03670 or 12.5.0-03082 (or later) on all SMA 1000 appliances. Given the exploitation history of this product line, any delay creates a real risk of compromise.
Checking for compromise: based on Rapid7’s recommendations for the previous attack chain, administrators should check for the following indicators:
- In the
extraweb_access.logfile — requests towsproxyreturning HTTP 101 with suspicious host parameters resembling localhost - In the
ctrl-service.logfile — invocations of theremove_hotfixutility with directory traversal sequences indicating third-party scripts
These indicators are designed to detect exploitation of CVE-2026-15409 and CVE-2026-15410 and are not specific to CVE-2026-102255, but they may point to a previously unnoticed compromise of the device.
Post-exploitation measures: if signs of compromise are found, all credentials stored on the appliance must be reset, active sessions revoked, and MFA TOTP seeds regenerated — these are exactly the data attackers extracted in previous attacks.
SonicWall SMA 1000 appliances have, for the third time in 2026, become the subject of critical vulnerabilities with confirmed or suspected exploitation. Organizations operating these devices should not only apply the current patch but also audit logs for the past few months for missed compromises, and assess whether it is appropriate to limit direct internet access to the SMA 1000 management interface.
