SonicWall SMA1000 vulnerability (CVE-2026-102255): the before, during and after response card
On Tuesday, October 6, 2026, SonicWall published an advisory for CVE-2026-102255, a SonicWall vulnerability rated 10 out of 10 in the Work Place interface of its SMA1000 remote access appliances. Three days later, Previdian’s honeypots were already detecting exploitation attempts, according to SC Media. At the time of writing, the flaw was not yet in CISA’s Known Exploited Vulnerabilities catalog, but every expert quoted agrees: don’t wait.
The 30-second summary
- What: a server-side request forgery (SSRF) flaw, exploitable without a password.
- Who: SonicWall SMA1000 appliances (models 6210, 7210 and 8200v) with the Work Place interface exposed to the internet.
- Why it matters: the appliance that controls remote access becomes the entry point itself. Multi-factor authentication does not block this route.
- Fix: versions 12.4.3-03670 or 12.5.0-03082. No workaround, according to Suzu Labs.
The 3rd 10/10 flaw of the same kind in 9 months
Denis Calderone, CTO at Suzu Labs, points out that this is the third CVSS 10.0 pre-authentication SSRF in the Work Place interface in nine months: July, September and now October. His most worrying observation: “The firmware SonicWall released in September to fix the last chain is exactly what’s vulnerable to this one.” In other words, appliances carefully updated last month are exposed again.
In practice, the flaw lets an attacker make the appliance send requests to its own internal services, which were never supposed to be reachable from outside. The observed attempts target the internal CouchDB service, and a public Metasploit module from the September chain already shows how to turn that access into root-level code execution.
The response card: before, during, after
① BEFORE patching
- Find all your SMA1000 units (6210, 7210, 8200v).
- Export the configuration.
- Have console access ready (not over the VPN).
- If you can’t patch right away: take the Work Place interface off the internet.
② DURING
- Install 12.4.3-03670 or 12.5.0-03082.
- The appliance reboots and drops all VPN sessions: plan a short maintenance window.
- Do not apply the hotfix over the VPN itself.
③ AFTER
- Confirm each appliance runs the fixed version.
- Hunt for the traces below.
- If anything looks off: re-image the appliance before deploying the new firmware.
As Calderone puts it: “Patching a compromised box just gives you a patched compromised box.” Sectigo’s Jason Soroko adds that patching closes the vulnerability but does not establish whether an attacker already got in.
4 traces to look for in the logs
SonicWall has not published indicators of compromise for this flaw. Suzu Labs recommends reusing those from the July chain, since the internal architecture hasn’t changed:
What if you don’t use SonicWall?
The lesson applies to every “edge” device (firewalls, VPN gateways, remote access appliances), as we saw with FortiBleed at Fortinet and the Citrix NetScaler zero-days. These devices face the internet, attackers often target them right before a weekend, and a patch is no substitute for a check. Our automated 24/7 monitoring with on-call technician response helps spot abnormal connections, and our cybersecurity services include patch management for your network devices.
Book your free cyber check
Not sure which of your network devices face the internet, or whether they’re up to date? We’ll take inventory with you and tell you what to fix first.
Call us at 438-476-2322 or email info@neotechcloudsolutions.com.
Sources
Photo: Brett Sayles, Pexels (Pexels licence).