ATTACKERS are already targeting SonicWall SMA 1000 appliances with a critical SSRF flaw tracked as CVE-2026-102255, which carries a CVSS score of 10.0. The vulnerability is a pre-authentication server-side request forgery via an unintended alternate access path in the SMA1000 Appliance Work Place interface. By abusing this path, a remote unauthenticated attacker could cause the appliance to issue requests on its own behalf, reaching internal functionality and performing unauthorized operations. The advisory notes that there is no login required to exploit the flaw.
Affected products are SMA1000 models in the 6210, 7210 and 8200v lines, running versions 12.4.3-03526 (platform-hotfix) and older, or 12.5.0-02952 (platform-hotfix) and older. SonicWall states that the issues do not impact SSL-VPN on SonicWall firewalls or the SMA 100 Series product line, and that there is no workaround available; a hotfix is available via the MySonicWall portal. While the vendor initially reported no evidence of exploitation, multiple researchers have since observed exploitation activity.
Defused detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys since 8 October 2026, and Previdian sensors have logged exploitation attempts, including activity attributed to IP 146.70.143[.]142, consistent with CVE-2026-102255. About 135 attack attempts had been recorded from two US IP addresses, according to Previdian’s telemetry. SonicWall has yet to update its security advisory to confirm active exploitation.