# SonicWall SMA1000: max-severity pre-auth SSRF exploited days after the patch (CVE-2026-102255) · pwn.watch

> CVE-2026-102255 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface: an unintended alternate access path lets a remote attacker make the appliance send requests to internal functionality and perform unauthorized operations. It affects SMA1000 6210, 7210 and 8200v models (not SMA 100 or firewall SSL-VPN). SonicWall disclosed it on Oct 6; exploitation attempts began Oct 8, and Horizon3.ai warns it can lead to device takeover. Update to 12.4.3-03670 or 12.5.0-03082.

Page: https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255 · generated 2026-10-24T08:44:16.553Z

## Status
- Severity: critical · status: live · patch: patched
- Product: SonicWall SMA1000 (6210, 7210, 8200v)
- Started: 2026-10-06
- CVEs: CVE-2026-102255
- Affected: SMA1000 6210, 7210, 8200v before 12.4.3-03670 / 12.5.0-03082
- Fixed in: 12.4.3-03670; 12.5.0-03082

## Follow this incident
- RSS (one item per update): https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255/feed.xml
- JSON Feed: https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255/feed.json
- Full data (timeline, sources, posts, agentBrief): https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255.json
- This file: https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255/llms.txt

## Updates (newest first)
- 2026-10-09: BleepingComputer: the max-severity flaw is now exploited in attacks. (https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/)
- 2026-10-08: Defused decoys record the first exploitation attempts (crafted OPTIONS requests aimed at internal CouchDB); Previdian also sees attempts. (https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/)
- 2026-10-06: SonicWall discloses CVE-2026-102255 and ships fixed SMA1000 builds. (https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/)

## Fix brief
# Security brief: SonicWall SMA1000: max-severity pre-auth SSRF exploited days after the patch (CVE-2026-102255)

Source: https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255 · status: live · severity: critical · updated Oct 24, 2026, 06:40 UTC

## Patch status
**PATCHED: fixed releases exist. Upgrade to a fixed version.**

## What it is
CVE-2026-102255 (CVSS 10.0) is a pre-authentication server-side request forgery in the SMA1000 Appliance Work Place interface: an unintended alternate access path lets a remote attacker make the appliance send requests to internal functionality and perform unauthorized operations. It affects SMA1000 6210, 7210 and 8200v models (not SMA 100 or firewall SSL-VPN). SonicWall disclosed it on Oct 6; exploitation attempts began Oct 8, and Horizon3.ai warns it can lead to device takeover. Update to 12.4.3-03670 or 12.5.0-03082.

Severity detail: CVSS 10.0; pre-auth; exploitation attempts observed since 2026-10-08

- Product: SonicWall SMA1000 (6210, 7210, 8200v)
- CVE / advisory ids: CVE-2026-102255

## Affected versions
- SMA1000 6210, 7210, 8200v before 12.4.3-03670 / 12.5.0-03082

## Check whether you're affected
No generic command applies (the product is a hosted service, appliance or desktop app). Check the installed version in its admin UI / About screen and compare with the versions above.

## Fix
Upgrade to one of these fixed versions (or later on the same branch):
- 12.4.3-03670
- 12.5.0-03082

After upgrading, re-run the checks above and redeploy/restart the affected services.

## Latest updates
- Oct 9, 2026: BleepingComputer: the max-severity flaw is now exploited in attacks.
- Oct 8, 2026: Defused decoys record the first exploitation attempts (crafted OPTIONS requests aimed at internal CouchDB); Previdian also sees attempts.
- Oct 6, 2026: SonicWall discloses CVE-2026-102255 and ships fixed SMA1000 builds.

## Advisories
- [SonicWall Releases Critical Security Advisory for SMA1000 Series Appliances (CC-4863)](https://digital.nhs.uk/cyber-alerts/2026/cc-4863) (NHS England Digital)

## Write-ups & news
- [Critical SonicWall Vulnerability Exploited Days After Disclosure](https://www.securityweek.com/critical-sonicwall-vulnerability-exploited-days-after-disclosure/)
- [Max severity SonicWall SMA1000 flaw now exploited in attacks](https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/)
- [Critical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch](https://thehackernews.com/2026/10/critical-sonicwall-sma-1000-flaw.html)

## Caveats
Not in CISA KEV as of the 2026-10-23 catalog. No successful compromise has been publicly confirmed; reports describe exploitation attempts.

---
Machine-readable: https://pwn.watch/i/sonicwall-sma1000-ssrf-cve-2026-102255.json · all incidents: https://pwn.watch/incidents.json. Verify against the vendor advisory before changing production systems.