Attackers probe max-severity SonicWall SMA1000 flaw days after patch, with no confirmed victims so far

What happened

On 6 October SonicWall released hotfixes for four vulnerabilities in its SMA1000 remote access gateways, bundled in advisory SNWLID-2026-0017. The most serious, CVE-2026-102255, is a server-side request forgery (SSRF) that requires no authentication. According to the advisory from the Centre for Cybersecurity Belgium (CCB), which cites the vendor, an unintended alternate access path in the Work Place interface turns the appliance into a forwarding proxy: an attacker without credentials can make the gateway send requests on their behalf and reach internal functions. It carries the maximum score, CVSS 10.0.

When the advisory went out, SonicWall said it had no evidence of exploitation, as Help Net Security reported. Two days later, threat intelligence firms Defused and Previdian began seeing malicious traffic against their honeypots. By 12 October Previdian had logged 135 attempts from two US IP addresses, according to The Hacker News.

The same advisory fixes a post-authentication command injection requiring admin rights (CVE-2026-102256, CVSS 7.8) and a Zip Slip, a path traversal triggered when extracting archives, in the AMC management console (CVE-2026-102257, CVSS 7.2); both lead to remote code execution. The fourth is a stored XSS in the AMC (CVE-2026-102258, CVSS 5.5).

What is confirmed and what is not

The key distinction: the attacks observed so far hit decoys, not real organisations.

• Confirmed (CCB and SonicWall): affected models are SMA1000 6210, 7210 and 8200v, including virtual deployments, running 12.4.3-03526 or earlier and 12.5.0-02952 or earlier (platform-hotfix). Fixed in 12.4.3-03670 and 12.5.0-03082, per The Hacker News.
• Confirmed (SonicWall, cited by Security Affairs): firewall SSL-VPN and the SMA 100 series are not affected, and there is no workaround.
• Confirmed (CCB): on 12 October it added that “many sources” report active exploitation. The authority is relaying third-party reports, not confirming attacks itself.
• Unconfirmed (Previdian, via BleepingComputer): attempts consistent with the CVE across its honeypot network. Its founder says they have not yet determined whether any attempt would have compromised a system.
• Unconfirmed (Defused, via Security Affairs): unauthenticated SSRF traffic against its decoys since 8 October, which it flagged to customers.
• No victims: no organisation has said it was breached and no authority has attributed victims. As of 13 October, eSecurity Planet reported, SonicWall's advisory still said there was no evidence of exploitation.
• No attribution: nobody has linked the attempts to a specific group.

Why it matters

SMA1000 appliances sit at the network edge and are used by mid-sized and large enterprises, managed security service providers and government bodies, according to Help Net Security and BleepingComputer. The CCB warns an attacker could reach internal systems and sensitive data, change the appliance configuration or disrupt remote access. SOCRadar cautions that it has not been shown that the SSRF alone allows code execution or full device compromise: that depends on which internal services the appliance can reach.

Recent history adds weight. In July attackers spent weeks exploiting two SMA1000 zero-days to deploy custom malware, and CISA later tied some of those attacks to ransomware gangs, BleepingComputer reported. In September SonicWall confirmed exploitation of another pre-authentication SSRF in Work Place, also rated CVSS 10.0. Previdian says the current attempts target the same interface using a different technique.

BleepingComputer notes that CISA has added 19 SonicWall flaws to its KEV catalogue in four years, 13 of them flagged as used by ransomware. Shadowserver counts more than 400 internet-exposed SMA1000 devices, though it is unclear how many are honeypots or already patched.

Timeline

Three rounds of serious flaws in the same product in roughly three months.

1. July 2026zero-days CVE-2026-15409 and CVE-2026-15410 exploited for weeks (BleepingComputer).
2. 1 SeptemberSonicWall publishes SNWLID-2026-0016 and confirms exploitation of CVE-2026-83548 and CVE-2026-83549 (Rapid7, Field Effect).
3. 6 OctoberSonicWall publishes SNWLID-2026-0017 with hotfixes, citing no evidence of exploitation.
4. 7 Octoberthe CCB issues its advisory urging immediate patching.
5. 8 Octoberfirst malicious traffic hits Defused and Previdian decoys.
6. 9 Octoberboth firms go public and BleepingComputer reports exploitation.
7. 12 Octoberthe CCB adds its active exploitation note; The Hacker News reports 135 attempts.
8. 13 OctoberSonicWall's advisory still does not acknowledge exploitation, per eSecurity Planet.

What organisations can do

The hotfix is the only fix. Everything else is about finding out whether someone got in first.

• Install 12.4.3-03670 or 12.5.0-03082 or later from the MySonicWall portal. The CCB urges top priority after testing.
• Remember that patching does not undo an earlier compromise, as the CCB stresses: review appliances that were exposed.
• Review proxy and appliance logs since 6 October for HTTP OPTIONS requests against the WorkPlace interface and references to the appliance's internal CouchDB service, which Previdian says the SSRF targets (CISO Platform).
• Look for requests to CouchDB rewrite functions and login attempts using default credentials (SOCFortress blog, medium reliability).
• Check logs against the IP published by Previdian, 146.70.143[.]142, a single-source private indicator.
• Restrict the AMC management console to administrative networks and step up monitoring. Organisations in Belgium can report incidents to the CCB.

What to watch next

The decisive question is whether a real victim emerges. So far nobody has shown that a production SMA1000 was compromised, or that attackers are chaining the SSRF with CVE-2026-102256 or CVE-2026-102257 to run code. No public exploit has been found either.

Watch whether SonicWall updates its advisory to acknowledge exploitation and whether CISA adds the CVE to its KEV catalogue; as of 14 October no inclusion has been reported, though the catalogue itself was not checked. Still unknown: how many of the 400-plus exposed devices remain unpatched, and who is behind the attempts.

Sources

• CCB (CERT.be) advisory on SonicWall SMA1000
• SonicWall PSIRT advisory SNWLID-2026-0017
• SonicWall product notice: SMA 1000 multiple vulnerabilities
• BleepingComputer: Max severity SonicWall SMA1000 flaw now exploited
• Security Affairs: SonicWall patches CVSS 10.0 SSRF flaw as attacks begin
• The Hacker News: 135 exploitation attempts against SMA 1000 flaw
• Help Net Security: SonicWall fixes pre-auth SSRF in SMA 1000
• eSecurity Planet: SonicWall flaw targeted two days after disclosure
• SOCRadar: CVE-2026-102255 analysis
• Rapid7: September 2026 SMA1000 zero-days exploited

Vulnerabilities (8)