SonicWall SMA1000 Hit a CVSS 10 SSRF Again, and Scanners Showed Up in Two Days

If your remote-access appliance needed a hobby, it picked “being a confused deputy.” CVE-2026-102255 is a pre-auth SSRF in the SMA1000 WorkPlace interface, scored a clean 10.0, patched on October 6, and probed on honeypots by October 8. This is the third max-severity WorkPlace SSRF SonicWall has shipped since July. The September “fixed” builds are the October “affected” builds. Take a bow, patch train.

SonicWall advisory SNWLID-2026-0017 covers four bugs on SMA1000 models 6210, 7210, and 8200v. The headline is CVE-2026-102255: pre-authentication server-side request forgery via an “unintended alternate access path” that lets a remote attacker tell the appliance to issue requests on their behalf and reach internal functionality. Defused and Previdian both reported unauthenticated SSRF traffic against decoys and sensors within two to three days of the advisory. Neither claimed a confirmed production compromise. SonicWall’s advisory still says it had no evidence of exploitation at publication. CISA’s KEV catalog had not listed this CVE as of mid-October checks by multiple outlets. That is not a free pass. That is a clock.

What the bug actually is

SonicWall’s own heading calls it “Pre-authentication SSRF via unintended forward-proxy.” Same phrasing as the September sibling. Same CWE pair: CWE-918 (SSRF) and CWE-441 (unintended proxy / confused deputy). Previdian founder Ryan Dewhurst told BleepingComputer the observed probes used crafted OPTIONS requests against the WorkPlace Extraweb interface aimed at the appliance’s internal CouchDB on 127.0.0.1:5984, including attempts to hit a design document _rewrite with Basic auth admin:admin. Public writeups also note a prior Metasploit path from the September chain that turned CouchDB access into root on these appliances. Architecture did not magically get less chatty.

Also in the October advisory:

• CVE-2026-102256 (CVSS 7.8): post-auth OS command injection for an authenticated admin
• CVE-2026-102257 (CVSS 7.2): post-auth Zip Slip in the Appliance Management Console, can lead to RCE
• CVE-2026-102258 (CVSS 5.5 in the advisory; NVD lists 6.1): post-auth stored XSS in AMC

Credits: Benoît Sevens of Anthropic on the SSRF and command injection; Brian Mariani on the Zip Slip and XSS (via ZDI and DigitalCanion). SMA 100 Series and SSL-VPN on SonicWall firewalls are not in scope. There is no workaround. Only the hotfix builds.

The patch treadmill joke writing itself

July: SNWLID-2026-0008, CVE-2026-15409 (SSRF 10.0) plus a post-auth code injection, with SonicWall investigating active exploitation and Volexity tracking UTA0533. September: SNWLID-2026-0016, CVE-2026-83548 (another SSRF 10.0) plus post-auth command injection, again with investigation of exploitation. October: same WorkPlace surface, new technique per Dewhurst, and the July/September “good” builds are now listed as vulnerable ceilings.

• Fixed now: 12.4.3-03670 or 12.5.0-03082 (platform-hotfix) and later
• Affected examples called out publicly: 12.4.3-03526 and older, 12.5.0-02952 and older (the September “fixed” line)

Field Effect and others said the quiet part out loud: if you stopped at the September hotfix, you are still in the blast radius. Singapore’s AL-2026-137 even listed the July builds as the recommended target for a while, which is how government alerts earn side-eye. Use SonicWall’s numbers, not a secondary paraphrase.

What scanners looked like

Previdian posted a scanning source of 146.70.143.142 and roughly 135 attempts on one sensor across October 9 to 10 from two US source IPs (per roundups). Defused tagged loopback SSRF traffic on its SMA decoys starting October 8. Horizon3 said it was investigating possible device takeover. Shadowserver counts cited by BleepingComputer put more than 400 SMA1000 faces on the internet, with no clean split between honeypots and unpaid homework.

Important honesty check: attempts on decoys are not the same as “your CFO’s VPN is owned.” Do not invent victims. Do inventory builds.

What to actually do

1. Confirm platform-hotfix strings on every 6210 / 7210 / 8200v. Push 12.4.3-03670 or 12.5.0-03082+. The appliance reboots and drops VPN sessions. Plan a window. Do not apply the hotfix over the VPN you are standing on unless you enjoy long walks.
2. Hunt retained proxy, WAF, and appliance logs for WorkPlace requests whose request line is a full URL, OPTIONS traffic mentioning 127.0.0.1, port 5984, _design, or _rewrite, and the published scanner IP above (weak indicator, rotate as intel updates).
3. Restrict what the appliance can reach on the inside. An SSRF is only as boring as your internal services are boring.
4. If you match weird loopback OPTIONS / CouchDB patterns, open an incident and call SonicWall support. The October advisory is thin on compromise-check guidance compared to some earlier notes.
5. Watch for a KEV add. July and September pairs landed on KEV fast once SonicWall said it was investigating exploitation. This one may follow.

Detection ideas you can paste into a SIEM tonight

SonicWall’s October advisory is light on IOCs. Researchers filled some gaps. Translate them into queries your logging actually supports:

• Request-line anomalies: WorkPlace or Extraweb hits where the request target is an absolute URL (scheme + host) instead of a path. That is the “unintended forward-proxy” smell.
• Loopback CouchDB: any log field containing 127.0.0.1:5984, _design, _rewrite, or Basic auth attempts with default-looking credentials aimed at internal services.
• OPTIONS bursts: unauthenticated OPTIONS against the portal from hosting providers, especially clustered in minutes.
• Build drift: CMDB or config-management check that flags SMA1000 platform-hotfix strings still on 12.4.3-03526 / 12.5.0-02952 or older.

Previdian’s published scanner IP (146.70.143.142) is a single sensor observation, not a magic blocklist. Use it as a seed, not a career. Correlate with your own geo and ASN baselines for SSL VPN and management-plane traffic.

Why MSSPs should feel specifically attacked

Help Net Security and others note SMA1000 shows up at mid-to-large enterprises, government, and managed security providers. Shared infrastructure means one forgotten hotfix becomes twenty customer tickets and one very awkward QBR. If your NOC still treats “VPN appliance” as a set-and-forget virtual appliance image from 2024, congratulations on volunteering as initial access.

Also stop applying emergency hotfixes over the same VPN tunnel the hotfix is about to reboot. That joke writes itself every time, and the on-call engineer is the punchline.

A short timeline for the change ticket

• 2026-07-14: SNWLID-2026-0008, CVE-2026-15409 SSRF 10.0 actively investigated, KEV same day
• 2026-09-01: SNWLID-2026-0016, CVE-2026-83548 SSRF 10.0, exploitation case investigated, KEV next day
• 2026-10-06: SNWLID-2026-0017 publishes CVE-2026-102255 with “no evidence” language
• 2026-10-08: Defused decoys see unauthenticated SSRF traffic
• 2026-10-09: Previdian sensors report attempts, public scanner IP noted
• 2026-10-12: Independent roundups confirm advisory still unrevised; KEV still quiet on this CVE

That cadence is the story. Disclosure, probe, argue about wording while the hotfix sits in a download portal. If your vulnerability SLA is “30 days for criticals,” print this timeline and ask whether SMA1000 deserves its own angry exception.

CouchDB on localhost is not a personality quirk

Remote-access gear loving internal data stores is an old pattern. Once an unauthenticated request can coerce the appliance into talking to 127.0.0.1, every cozy default becomes a ladder rung. Public notes about admin:admin Basic auth attempts against CouchDB design docs should make you inventory what else listens on loopback: management APIs, debug ports, packaging endpoints. SSRF is a capability, not a single CVE narrative. Closing one alternate path without asking what the appliance can still reach is how you buy tickets to advisory number four.

Sloth take

Edge appliances keep auditioning for the same role: internet VIP with a backstage pass to localhost. Vendors ship a 10.0, say “no evidence,” honeypots light up like a Christmas tree, and MSPs schedule the reboot for “next Saturday maybe.” Your board slide that says “VPN modernized in Q3” needs a footnote that says “and again in Q4, and again after that.” Patch the hotfix. Log the OPTIONS nonsense. Stop pretending the WorkPlace portal is a lifestyle brand.

Need a grown-up to look at your edge stack? Book a slot with Dark Edge Consulting. We do the boring, careful work so you can go back to ignoring your inbox.

Sources

• SonicWall SNWLID-2026-0017 (Oct 6, 2026) and prior SMA1000 advisories SNWLID-2026-0008 / 0016
• SXZ.io roundup with advisory comparison (2026-10-12): sxz.io
• Dark Reading, Max-Severity SSRF Flaw in SonicWall SMA Devices Under Attack
• SC Media / BleepingComputer reporting on Previdian and Defused sensor hits; scanner IP 146.70.143.142
• Field Effect and Help Net Security notes on affected builds and exposure