SonicWall SMA1000 gets a third CVSS 10 pre-auth SSRF this year

SonicWall advisory SNWLID-2026-0017, published October 6, fixes four flaws in the SMA1000 remote access appliances (models 6210, 7210 and 8200v). The serious one is CVE-2026-102255, a server-side request forgery in the WorkPlace interface rated CVSS 10.0. NVD describes it as an unintended alternate access path that a remote, unauthenticated attacker can use to make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations. Builds 12.4.3-03526 and 12.5.0-02952 and older are affected; 12.4.3-03670 and 12.5.0-03082 fix it. There is no workaround. The other three flaws need a login. SonicWall said it had no evidence of exploitation at disclosure, and the CVE is not on CISA's KEV list. Benoît Sevens of Anthropic reported it.

Why it matters

The SMA1000 is the login page for remote access. A path that reaches internal functions before authentication means the identity check, and the MFA step attached to it, is not standing between the internet and the appliance's back end. SonicWall has not said which internal operations are reachable, so assume the worst until it does.

This is the third no-login WorkPlace SSRF rated 10.0 that SonicWall has fixed in 2026, and the July pair was exploited as zero-days. The pattern matches other remote access gateways, such as Ivanti Connect Secure this month: the gateway is where credentials and sessions pass, so it is where attackers start. Patch, keep WorkPlace and the management console off untrusted networks, and if you ran a vulnerable build exposed to the internet, review appliance admin accounts and rotate the directory bind credentials it holds.

Update, October 28, 2026: Honeypots began recording exploitation attempts within two days of disclosure. Previdian and Defused told BleepingComputer on October 9 that unauthenticated requests to the WorkPlace interface were trying to reach the appliance's internal CouchDB service on port 5984 with hardcoded credentials. Neither firm confirmed a successful compromise, and as of October 28 the CVE is still not in CISA's KEV catalog. Treat exposed, unpatched appliances as targeted.

Source: The Hacker News