Since 8 October, attackers have been trying to exploit CVE-2026-102255, a maximum-severity flaw (CVSS 10.0) in SonicWall SMA1000 6210, 7210 and 8200v remote access gateways. SonicWall patched it on 6 October. If you run one of these appliances, confirm today that the patch is installed and limit its exposure to the internet.
Key facts
- CVE-2026-102255 has a CVSS score of 10.0. It is a pre-authentication SSRF (server-side request forgery), according to BleepingComputer.
- It affects the Appliance WorkPlace interface on SMA1000 models 6210, 7210 and 8200v. It does not affect the SMA 100 series or the SSL-VPN on SonicWall firewalls.
- SonicWall released the patch on Tuesday 6 October 2026. Previdian and Defused Cyber spotted the first signs of exploitation on 8 October.
- Previdian has logged 135 attempts from two US IP addresses, according to The Hacker News.
- Shadowserver counts more than 400 SMA1000 appliances exposed to the internet.
Am I affected if I have a SonicWall?
Only if you have an SMA1000 gateway, model 6210, 7210 or 8200v. It is the appliance many companies use so staff can connect to internal systems from outside. If you have an SMA 100 or use the SSL-VPN on a SonicWall firewall, this particular flaw does not affect you.
If you don't know which model you have because an IT provider manages it, the question goes to them. And you want the answer in writing.
What do we know about the attacks?
The flaw lets a remote attacker, with no credentials, make the appliance send requests on their behalf and reach internal functions. The observed attempts use a crafted OPTIONS request against the WorkPlace Extraweb interface to reach the internal CouchDB service (127.0.0.1:5984), and include the credentials admin:admin.
What we don't know: Previdian has not established whether those attempts would have compromised any system, and SonicWall had not flagged the flaw as exploited in its Tuesday advisory. Nor is it known how many of the 400-plus exposed appliances are honeypots or already patched.
Why the rush if no compromises are confirmed?
Because of the track record. This is the third SSRF vulnerability in the same WorkPlace interface in 2026: July, September and October. In September SonicWall warned that CVE-2026-83548 and CVE-2026-83549 were being chained in real attacks to execute remote code on SMA1000.
On top of that, over the last four years CISA has added 19 SonicWall vulnerabilities to its catalogue of exploited flaws, and 13 of them are used by ransomware gangs, according to BleepingComputer. Three days between patch and first attempts leaves little room to wait for the next maintenance window.
What to do today
- Check whether your company uses SonicWall SMA1000 6210, 7210 or 8200v. If a provider manages it, ask them now.
- Confirm the 6 October patch is installed and get that confirmation in writing. Check the fixed versions directly in SonicWall's official advisory.
- If it isn't applied, install it now. In the meantime, restrict internet access to the management interface and to WorkPlace.
- Review the logs from the last few days for unusual OPTIONS requests or logins with default credentials (admin:admin).
- If you find anything suspicious, treat it as an incident: don't just patch and move on.
What it means for a small business
The remote access gateway is the front door to your network. When it fails, an attacker doesn't need to trick anyone: they just need to find the appliance on the internet. That is why these flaws get exploited in days, not months.
Our view: the problem isn't just this patch. Three SSRFs in the same interface in one year, one of them already used to run code, is a pattern. If you have an SMA1000, patch today and then ask yourself two questions calmly. Does WorkPlace need to be open to the whole internet, or can you restrict who reaches it? Does your IT provider commit to patching critical flaws within days, or does it wait for the next monthly review?
If the answer to the second is the monthly review, that contract isn't built for today's pace of attacks. If you want a second opinion on how your remote access is set up, our cybersecurity service reviews exactly this.
Frequently asked questions
Have any companies been compromised through this flaw?
Not confirmed. Exploitation attempts have been logged, but Previdian has not established whether any would have compromised an appliance.
I have a SonicWall firewall with SSL-VPN. Do I need to do anything?
For this flaw, no. It only affects SMA1000 6210, 7210 and 8200v. It is still worth keeping the firewall up to date given the vendor's vulnerability history.
Is applying the patch enough?
The patch closes the flaw, but it doesn't tell you whether someone got in earlier. That is why you need to review the logs from the last few days.
