SonicWall SMA 1000 Users Urged to Patch Critical SSRF Flaw Amid Active US Attacks

Organisations relying on SonicWall SMA 1000 appliances face immediate operational risk as attackers exploit a critical server-side request forgery flaw. The vulnerability, tracked as CVE-2026-102255, carries a maximum CVSS score of 10.0 and allows unauthenticated remote attackers to force the appliance to issue requests. This capability enables access to internal functions and unauthorized operations without requiring login credentials, according to Security Affairs.

The risk

The flaw exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. Attackers can abuse this path to direct the appliance to perform actions on their behalf. SonicWall’s advisory states that this pre-authentication SSRF vulnerability allows remote unauthenticated attackers to reach internal functionality. The vendor initially reported no evidence of exploitation but recommended applying fixes immediately. However, multiple researchers now warn that the vulnerability is being actively exploited in the wild.

View the original post on X

View the original post on X

Who is exposed

Only SonicWall SMA 1000 appliances are affected by this specific vulnerability. The flaw does not impact SSL-VPN running on SonicWall firewalls or the SMA 100 Series product line, according to the vendor. Cybersecurity firm Defused detected unauthenticated SSRF traffic targeting its SonicWall SMA decoys starting October 8, 2026. Defused alerted subscribers through its Radar service regarding these targeted attacks.

Cost and compliance

Previdian reported that its sensors detected exploitation attempts consistent with CVE-2026-102255 targeting SonicWall SMA 1000 appliances. Researchers recorded 135 attack attempts from two different IP addresses located in the United States. One reported attacker IP address is 146.70.143[.]142. SonicWall has not yet updated its security advisory to confirm that attackers are successfully exploiting the flaw in production environments, according to Security Affairs.

What happens next

Managers should verify if their organisation uses SonicWall SMA 1000 appliances and check for the available hotfix. Since no workaround exists, applying the update is the only confirmed mitigation. Monitor network traffic for unusual SSRF patterns or connections to internal resources from these appliances.

Background: Firewalls

Firewalls are important because they enforce access policies at network boundaries, blocking unauthorized traffic before it reaches your devices. Without this filter, your systems face constant probing. This reduces the attack surface and prevents automated exploits from finding vulnerable services.

Read the full guide: Why Firewalls Are Important: The Hidden Costs of Missing Filters

What to do and how to stay safe: SonicWall

• Inventory all SonicWall SMA 1000 appliances to confirm exposure to CVE-2026-102255.
• Apply the vendor-provided hotfix immediately through the MySonicWall portal.
• Monitor logs for unauthenticated requests to the Work Place interface.
• Restrict external access to management interfaces where possible.

Step-by-step guide: Vulnerability Prioritization: Fix What Actually Breaks Your Business

General security guidance from the CloudSec Pulse newsroom. It is not confirmed advice from the organisations named in this story.

Frequently asked questions

Is the SonicWall SMA 1000 vulnerability actively being exploited?

Yes, researchers from Defused and Previdian have detected active exploitation attempts targeting the SMA 1000 appliances since October 8, 2026.

Does this flaw affect SonicWall firewalls or the SMA 100 Series?

No, the vendor stated that the flaws do not impact SSL-VPN on SonicWall firewalls or the SMA 100 Series product line.

Is there a workaround for CVE-2026-102255?

No, SonicWall pointed out that there is no workaround and users must apply the available hotfix.