CVE-2026-102255 – Critical Pre-Auth SSRF in SonicWall SMA 1000 Appliances Under Active Exploitation

Key takeaways

• CVE-2026-102255 is a Critical pre-authentication SSRF in SonicWall SMA 1000 appliances (CVSS 10.0).
• A remote, unauthenticated attacker can abuse an unintended alternate access path in the Work Place interface to force the appliance to issue requests and reach internal functionality.
• Exploitation attempts were observed shortly after disclosure; thousands of internet-exposed hosts are potentially at risk.
• Apply the vendor patch immediately and limit management interface exposure.

Overview

CVE-2026-102255 is a Critical pre-authentication server-side request forgery (SSRF) vulnerability affecting SonicWall SMA 1000 Secure Mobile Access appliances. Disclosed on October 7, 2026, the flaw resides in the SMA 1000 Work Place interface and stems from an unintended alternate access path. Because it requires no authentication and no user interaction, a remote attacker can direct the appliance to issue arbitrary requests on their behalf, potentially reaching internal functionality and performing unauthorized operations.

With a CVSS 3.1 base score of 10.0 (vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H), this is a maximum-severity issue that is trivial to reach from the network.

Technical details

The vulnerability exists because the SMA 1000 Work Place interface exposes an alternate access path that bypasses normal authentication checks. An unauthenticated remote attacker can submit specially crafted requests through this path, causing the appliance to act as a proxy and issue outbound or internal requests. This can expose internal services, bypass network segmentation, and allow unauthorized operations against systems that would otherwise be inaccessible from the internet.

Associated weaknesses: CWE-441 and CWE-918.

Severity & impact

Mention volume spiked shortly after disclosure, and exploitation attempts were observed within days. For daily signal trends, active exploitation indicators, and detailed timeseries data, see the CVE page.

Affected products

Vendor: SonicWall Product family: SMA 1000 series Secure Mobile Access appliances, specifically the Work Place interface.

For the full list of affected products and versions, see CVE page.

Actionable insights: what to do now

• Treat any internet-exposed SMA 1000 appliance as a high-priority target. Attackers began scanning and attempting exploitation within days of the patch release.
• Prioritize appliances with the Work Place interface exposed to the internet.
• Monitor for unusual outbound or internal connection requests originating from SMA 1000 appliances, especially to internal IP ranges.
• Assume compromise if anomalous SSRF-like traffic is observed before patching; investigate logs and consider incident response.

Remediation & mitigation

1. Apply the SonicWall patch for SNWLID-2026-0017 / CVE-2026-102255 immediately.
2. If immediate patching is not possible, restrict access to the SMA 1000 management and Work Place interfaces via VPN or allow-listed source IPs.
3. Disable or block external access to the Work Place interface until the appliance is patched.
4. Review appliance and perimeter logs for SSRF indicators, including unexpected internal or external requests from the SMA 1000.
5. After patching, verify the fix and rotate credentials for any accounts that may have been exposed through internal functionality.

References

• SonicWall PSIRT – SNWLID-2026-0017
• CVE detail and live signal data

Bottom line

CVE-2026-102255 is a Critical pre-auth SSRF in SonicWall SMA 1000 appliances with a CVSS 10.0 score. Exploitation activity followed quickly after disclosure. Apply the vendor patch now, restrict internet exposure of the Work Place interface, and monitor for abnormal appliance-initiated requests.

#CVE2026102255 #SonicWall #SMA1000 #SSRF #Critical #PreAuth #Vulnerability