Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Attackers are currently targeting a critical vulnerability in SMA 1000 appliances, putting SonicWall customers in a familiar yet unenviable position.

SonicWall customers are on the defensive once again, as threat actors are actively exploiting a maximum-severity vulnerability in the cybersecurity vendor’s unified secure access gateway, the Secure Mobile Access (SMA) appliance.

CVE-2026-102255 is a server-side request forgery (SSRF) flaw in the SonicWall SMA 1000 appliance’s WorkPlace interface, a Web-based portal for remote users. The vulnerability, which SonicWall assigned a maximum 10 out of 10 CVSS score, stems from an “unintended alternate access path,” according to the vendor’s advisory.

“By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations,” SonicWall wrote in the advisory, published Oct. 6.

Just a few days later, two cybersecurity vendors flagged exploitation activity for CVE-2026-102255 on their honeypot devices. On Oct. 9, cybersecurity threat intelligence firm Previdian warned in a post on the social media platform X that it had observed attempts to exploit its sensors. Similarly, cybersecurity vendor Defused noted on X that it saw unauthenticated SSRF traffic on the company’s SonicWall SMA decoys starting the day before.

SonicWall said last week that there was “currently no evidence” that CVE-2026-102255 or the three other CVEs disclosed in its advisory had been exploited in the wild. Dark Reading contacted SonicWall for comment on the third-party vendor reports, but the company did not respond at press time.

SSRF Attacks on SMA WorkPlace Interface

While the technical details of CVE-2026-102255 have not yet been published, the vulnerability’s CVSS score suggests the flaw may be trivial to exploit. In a blog post on Monday, SOCRadar researchers noted that successful exploitation of the flaw on SMA 1000 appliances will give an attacker control of the WorkPlace interface. The SMA appliance provides SSL VPN, clientless remote access, and zero-trust network access to corporate resources from on-premises, cloud, and hybrid environments.

“In practical terms, the internet-facing gateway can potentially act as a proxy into services that would not normally be reachable externally,” SOCRadar researchers wrote.

Because SMA 1000 devices typically sit between the public Internet and corporate applications, identity services, and internal network infrastructure, the WorkPlace interface presents an attractive target for threat actors. “If the WorkPlace interface can be abused to send internal requests, an attacker may be able to interact with services that were never intended to be internet-accessible,” SOCRadar researchers wrote.

SonicWall released a hotfix for the vulnerability and urged customers to apply it as soon as possible. The cybersecurity vendor said SSL-VPNs running on SonicWall firewalls or the SMA 100 Series product line are not affected by CVE-2026-102255 or the other three CVEs disclosed last week.

High Risks, Costs for SonicWall Customers

CVE-2026-102255 is the latest exploited vulnerability facing SonicWall customers, who have already had to manage multiple threats against other SonicWall products this year. In July, the Inc ransomware gang launched zero-day attacks exploiting two flaws, CVE-2026-15409 and CVE-2026-15410, in SMA 1000 Series appliances.

Edge devices, such as SSL-VPNs, have been highly popular targets for a variety of threat actors in recent years. Joe Toomey, vice president of underwriting security at cyber insurer Coalition, says the risk posed by such devices and their frequently exploited vulnerabilities is quantifiable, as they typically lead to numerous claims from cyber insurance customers.

“The big, big offenders in this space are largely security boundary devices and edge devices. And SSL VPN devices are almost uniformly bad,” Toomey tells Dark Reading. “There are none of them that are good, and there are some that are worse.”

Toomey says the risk of legacy edge devices is reflected in the cyber insurer’s pricing model, which Toomey is continually evolving based on claims data.

“I can tell you that, both at a technology level and a vendor level, the premium that you will be quoted from Coalition has an awful lot to do with what we see externally exposed from your company,” he says. “And if you’re using a vendor that we have had a bad claims history with, then your premium is going to be significantly higher than if you were not using that vendor.”

Toomy strongly recommends using zero-trust solutions and moving away from legacy SSL-VPNs.

“There’s half a dozen different technologies that you could adopt,” he says, “all of which would get you a cheaper premium with us and would make you significantly less likely to suffer a claim than if you used any of these legacy SSL-VPN devices.”