SonicWall's SMA1000 SSRF Reached Security Decoys Two Days After the Patch

TL;DR

• SonicWall's SMA1000 is a line of remote access appliances that organisations place at the network edge so that staff and partners can reach internal systems from outside the network.
• SonicWall published advisory SNWLID-2026-0017 on 6 October 2026 covering four flaws, the highest rated of which is CVE-2026-102255, a pre-authentication server-side request forgery in the Work Place interface with a CVSS v3 score of 10.0.
• The flaw sits in the same user-facing portal that attackers used as a zero-day twice during 2026, and the 12.5.0 build that fixed the September flaws is listed as affected in this advisory.
• Researchers at Defused reported that the first exploitation attempts reached their decoys on 8 October, two days after disclosure, while SonicWall's advisory, last updated on 6 October, states there is currently no evidence any of the four flaws are being exploited in the wild.
• A research honeypot captured a payload that aimed a request at a local service on port 5984, and that detail is what turns a scored SSRF into a concrete remediation order for the appliance owner.

What SonicWall's advisory says about the SMA1000

Advisory SNWLID-2026-0017 covers four vulnerabilities at once, with a publication date and a last-updated date of 6 October 2026, a status of applicable and a workaround field that reads none. The headline entry is CVE-2026-102255, a pre-authentication server-side request forgery in the SMA1000 Work Place interface caused by an unintended alternate access path, rated CVSS v3 10.0 with the vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H. SonicWall classifies it as both an SSRF and an unintended-proxy flaw, which is the CWE-441 confused-deputy pattern: the appliance is convinced to act as a forward proxy for the attacker's requests.

The other three entries carry lower ratings and a higher bar for an attacker. CVE-2026-102256 is a post-authentication OS command injection rated 7.8 that lets an authenticated attacker execute arbitrary commands. CVE-2026-102257 is a Zip Slip path traversal in the Appliance Management Console rated 7.2 that extracts files outside the intended directory and reaches remote code execution. CVE-2026-102258 is a stored cross-site scripting flaw in the same console rated 5.5. Credit for the first two goes to Benoît Sevens of Anthropic; the other two are credited to Brian Mariani through the Zero Day Initiative and DigitalCanion.

The affected list is concrete: models 6210, 7210 and 8200v running platform hotfix 12.4.3-03526 or older, and the same models on 12.5.0-02952 or older. Fixed hotfixes are 12.4.3-03670 and 12.5.0-03082 and higher, available to customers through MySonicWall. SonicWall states that SSL-VPN running on its firewall products is not affected, and Help Net Security reports that the SMA 100 series is not affected either.

The Work Place interface in a third disclosure round

The Work Place interface has now produced three rounds of urgent patching in the same year. Beazley Security's advisory tracks the pattern: threat actors exploited earlier SSRF flaws in this same interface as zero-days, disclosed by SonicWall in July and again in September 2026. The September round covered CVE-2026-83548, a pre-authentication SSRF, and CVE-2026-83549, a post-authentication OS command injection; CISA added both to its Known Exploited Vulnerabilities catalogue on 2 September 2026, and attackers chained them to reach unauthenticated remote code execution. Help Net Security identifies the two pre-authentication SSRF flaws leveraged as zero-days during 2026 as CVE-2026-15409 and CVE-2026-83548.

The operational consequence is specific. Anyone who applied the September hotfix to remediate the zero-day being exploited at that time is now running a build this advisory lists as affected, which means a second upgrade on the same interface within weeks. Beazley states plainly that organisations which installed 12.5.0-02952 must upgrade again. Patch cycles are where small teams lose time, and a repeated cycle on the same appliance is exactly the case that calls for a formal change window.

SonicWall has published no technical detail beyond the advisory text and no proof-of-concept is known, so a defender cannot reason about exploitation from a published write-up. Beazley notes that SonicWall's description of this flaw closely mirrors its description of CVE-2026-83548, the September SSRF in the same interface, and the vendor has not said whether this is a variant of the earlier bug or a bypass of its fix. For anyone planning exposure reduction, the honest position is that the same class of bug has returned on the same portal, which makes the portal itself the asset that deserves the attention.

Two days from patch to probe, measured on decoys

SecurityWeek reports that SonicWall disclosed the vulnerability on 6 October and that threat intelligence firms Previdian, formerly KEVIntel, and Defused warned of the first exploitation attempts by Friday. Defused said its SMA decoys received the first attempts on 8 October, two days after public disclosure. Horizon3.ai warned that successful exploitation could allow attackers to take over vulnerable devices.

The two accounts carry different dates. SonicWall's statement that there is currently no evidence of exploitation in the wild comes from an advisory first published and last updated on 6 October, two days before the decoy hits, and the capture taken on 13 October still shows that date; Beazley updated its own advisory on 9 October to record that security researchers had publicly reported exploitation attempts in the wild. Decoy traffic describes probes, which arrive before anyone can attribute a successful intrusion. For a defender, the practical reading is that, on this appliance, two days separated the public advisory from the first automated attempts recorded on decoys, which leaves little room to assume a quiet window after patching.

Help Net Security records in an update that Defused flagged exploit attempts starting on 8 October while noting that no confirmation exists yet that any attempt succeeded against a real deployment. The distinction matters for incident response: a probe wave is evidence about attacker interest, and it justifies log review and exposure reduction without automatically implying a breach.

The payload a research honeypot captured

Beazley published the payload its research honeypots captured, and the interesting part is the destination. The request is an OPTIONS call to http://127.0.0.1:5984/, a port CouchDB uses by default (our inference: Beazley does not name the service), wrapped in a path-traversal string and sent with a Safari user agent and an Origin header. A request to localhost inside an SSRF payload tells a defender which class of internal service the attacker expects to reach through the appliance, and it explains why an SSRF on a remote access gateway deserves a high severity rating even when the initial request does no damage itself.

A remote access appliance holds a privileged position on the network. It terminates sessions from outside, and it stores or mediates the credentials of the users who come through it. An SSRF that reaches internal functionality therefore lands behind the perimeter that the appliance exists to enforce, and the services it can reach are exactly the ones not designed for untrusted requests.

Beazley's interim controls are unglamorous and worth copying into a change request: restrict access to the Work Place interface to known source networks where business requirements allow, confirm that the Appliance Management Console is not reachable from the internet, and monitor the appliance for unexpected administrative activity, configuration changes or outbound connections until the fixed hotfix is installed.

A remediation order for an edge appliance

The order that follows from the sources is short, and the first step is inventory. Identify which SMA1000 units exist, whether they are 6210, 7210 or 8200v models, and which platform hotfix each one runs. A unit on 12.4.3-03526 or 12.5.0-02952 is in scope, and a unit already updated in September may still be in scope.

The second step is the hotfix, on both branches: 12.4.3-03670 or 12.5.0-03082, whichever matches the maintenance path of that unit. Because no workaround exists, the patch is the control, and the upgrade also closes the three post-authentication flaws in the same bulletin.

The third step is exposure. Restricting the Work Place portal to known source networks, as Beazley recommends, reduces the portal's exposure to automated scanning. Keeping the management console off the internet reduces the exposure of the console flaws in the same bulletin.

The fourth step is watching. Log review on an edge appliance is what turns a probe wave into evidence, and the Netics page on infrastructure monitoring with plain-language alerts covers the operating side of that. The earlier analysis of the Zimbra command injection describes another server product where a monitoring add-on turned into a command line.

Sources

Source: SonicWall PSIRT — SMA1000 Series Appliances Affected By Multiple Vulnerabilities, advisory SNWLID-2026-0017 — psirt.global.sonicwall.com, first published 2026-10-06, retrieved 2026-10-13 (four CVEs: CVE-2026-102255 pre-authentication SSRF via unintended forward-proxy rated CVSS v3 10.0 with vector AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H and CWEs 918 and 441; CVE-2026-102256 post-authentication OS command injection rated 7.8; CVE-2026-102257 Zip Slip in the Appliance Management Console rated 7.2; CVE-2026-102258 stored XSS in the console rated 5.5; affected models 6210, 7210 and 8200v on 12.4.3-03526 and older and 12.5.0-02952 and older; fixed hotfixes 12.4.3-03670 and 12.5.0-03082 and higher; workaround none; status applicable; credits to Benoît Sevens of Anthropic and Brian Mariani through the Zero Day Initiative and DigitalCanion; statement that there is currently no evidence any of the vulnerabilities are being exploited in the wild; SSL-VPN on SonicWall firewalls not affected). Source: SecurityWeek — Critical SonicWall Vulnerability Exploited Days After Disclosure — securityweek.com, published 2026-10-12, retrieved 2026-10-13 (disclosure on 6 October with upgrade guidance to 12.5.0-03082 and 12.4.3-03670; first exploitation attempts warned by Previdian, formerly KEVIntel, and Defused; Defused decoys received attempts on 8 October, two days after disclosure; Horizon3.ai warning that successful exploitation could allow device takeover). Source: Beazley Security — Critical Server-Side Request Forgery Vulnerability in SonicWall SMA1000 (CVE-2026-102255), advisory BSL-A1223 with the 2026-10-09 update — labs.beazley.security, retrieved 2026-10-13 (earlier SSRF flaws in the same Work Place interface exploited as zero-days after July and September 2026 disclosures; CVE-2026-83548 and CVE-2026-83549 added to the CISA Known Exploited Vulnerabilities catalogue on 2026-09-02 and chained for unauthenticated remote code execution; the 12.5.0 build that fixed the September flaws listed as affected here; no public proof of concept known; Previdian Cyber exploitation reporting and recorded attacker address; research honeypot payload, an OPTIONS request to 127.0.0.1:5984 wrapped in path-traversal sequences and sent with a Safari user agent and an Origin header; organisations that installed 12.5.0-02952 to remediate the September exploitation must upgrade again; SonicWall's description of CVE-2026-102255 closely mirrors its description of CVE-2026-83548; fixed hotfixes available to customers through MySonicWall; interim controls covering Work Place exposure, management console reachability and monitoring). Source: Help Net Security — SonicWall fixes pre-auth SSRF flaw in SMA 1000 appliances (CVE-2026-102255) — helpnetsecurity.com, published 2026-10-07 with a 2026-10-12 update, retrieved 2026-10-13 (SMA 1000 series described as SSL VPN gateways used by medium to large enterprises, managed security service providers and government agencies; CVE-2026-15409 and CVE-2026-83548 leveraged as zero-days during 2026; Defused Cyber flagging exploit attempts from 8 October with no confirmation of success against real deployments; firewall products and the SMA 100 series unaffected). Figures: captures of the SonicWall PSIRT advisory page and the PSIRT vulnerability index, taken 2026-10-13.

Netics editorial diagrams: the scorecard is drawn from the vendor advisory, the checklist from the advisory and Beazley Security's interim controls.