SonicWall SMA1000 remote access boxes are being probed three days after the fix. Install the October hotfix

SonicWall shipped a fix for a 10.0-rated bug in its SMA1000 remote access appliances on October 6. On October 9, Previdian’s honeypots started logging exploitation attempts: 135 of them from two IP addresses by October 10.

This is the third no-login WorkPlace flaw SonicWall has patched on SMA1000 this year. The first two were exploited in real attacks.

Patched on Tuesday, probed by Friday. If your SMA1000 waited for the weekend to pass, it is on the clock now.

The 5-Minute Cyber Brief

Don’t Miss the Policy Changes That Affect Security Decisions

Get the key CISA actions, new regulations, guidance, and risk shifts in a quick daily brief.

Email addressSend me tomorrow’s brief

By subscribing you agree to our Privacy Policy.

Free. Weekday mornings. 5 minutes or less.

SonicWall SMA1000 bug drew attack traffic three days after the fix

CVE-2026-102255 is a pre-authentication server-side request forgery (SSRF) bug in the SMA1000 WorkPlace interface, the portal users sign in to. SonicWall says an unintended alternate access path lets a remote attacker “direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.”

SonicWall’s advisory SNWLID-2026-0017 fixed it alongside three bugs that need a login: an OS command injection (CVE-2026-102256), a Zip Slip archive flaw (CVE-2026-102257) and a stored XSS (CVE-2026-102258). SonicWall said at release it had no evidence of exploitation. Previdian records them as attempts and has not said whether any would have compromised a real appliance. The bug was not in CISA’s KEV catalog as of the catalog’s October 8 update.

Which SMA1000 appliances are in scope

Affected: SMA1000 models 6210, 7210 and 8200v on 12.4.3-03526 and older or 12.5.0-02952 and older. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected.

Those vulnerable builds include the September 1 hotfix that closed the last exploited pair. An appliance patched in September and left alone since is exposed again. In the July attacks, according to The Hacker News, the earlier SSRF opened a tunnel to services inside the appliance and a second bug gave the attacker root.

Install 12.4.3-03670 or 12.5.0-03082 now

• Install platform-hotfix 12.4.3-03670 or 12.5.0-03082 (or later) from MySonicWall. The appliance restarts after install, so schedule a short outage. There is no workaround.
• Until it is installed, limit who can reach WorkPlace from the internet if your setup allows it.
• After patching, check the appliance and its admin accounts using the steps SonicWall gave for the July and September cases: look for indicators, and if you find any, re-image, reset passwords and reset TOTP.

Details

• Advisory: SNWLID-2026-0017, October 6, 2026.
• CVEs: CVE-2026-102255 (pre-auth SSRF, WorkPlace, CVSS 10.0); CVE-2026-102256 (OS command injection, admin login, 7.8); CVE-2026-102257 (Zip Slip in AMC, login, 7.2); CVE-2026-102258 (stored XSS in AMC, admin login, 5.5).
• Fixed: 12.4.3-03670 and higher; 12.5.0-03082 and higher. Models 6210, 7210, 8200v.
• Exploitation: Previdian sensors logged 135 attempts from two IP addresses, first seen October 9 and last seen October 10. Success not confirmed; not on CISA KEV (catalog version 2026.10.08).

Hunt / verify

• WorkPlace access logs from October 6 on: requests from addresses you do not recognize that hit unusual paths before any login.
• New or changed administrator accounts in the Appliance Management Console.
• Outbound connections from the appliance to addresses it has never talked to.

Slack paste: SonicWall SMA1000 CVE-2026-102255 (CVSS 10, no login, SNWLID-2026-0017): exploitation attempts since Oct 9 (Previdian). Action: install 12.4.3-03670 or 12.5.0-03082 on 6210/7210/8200v today (reboot), then review admin accounts.

Sources

• SonicWall PSIRT: SNWLID-2026-0017 SMA1000 advisory
• The Hacker News: SonicWall patches CVSS 10.0 pre-authentication SSRF flaw in SMA1000 appliances (October 7, 2026)
• Previdian: CVE-2026-102255 exploitation observed
• CISA: Known Exploited Vulnerabilities catalog

George Bailey

George Bailey is the byline of the CyberExperts editorial desk, the team behind the CyberExperts Daily Brief. The desk covers vulnerabilities, breaches and security news from vendor advisories, CISA alerts and other primary sources, and links those sources in every story. Questions or corrections: [email protected].