Pre-authentication SSRF in SonicWall SMA1000 Work Place interface reaches internal functionality (CVE-2026-102255)
BleepingComputer reported on 2026-10-09 that attackers are exploiting the flaw three days after SonicWall's patch, and the Canadian Centre for Cyber Security updated AV26-1017 the same day to note in-the-wild exploitation, so an SMA1000 still on the affected hotfix is exposed to unauthenticated attack right now.
An unintended alternate access path in the SMA1000 Work Place interface lets a remote, unauthenticated attacker make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations. The flaw is rated CVSS 10.0 with scope change, meaning compromise extends beyond the vulnerable component.
Affected: SonicWall SMA1000 (models 6210, 7210, 8200v) 12.4.3-03526 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.4.3-03670 and prior); SonicWall SMA1000 12.5.0-02952 (platform-hotfix) and older (Canadian advisory AV26-1017 lists 12.5.0-03082 and prior)
How to Test
On each SMA1000 (6210, 7210, 8200v) check the running platform-hotfix build against the affected ranges (12.4.3-03526 / 12.5.0-02952 and older per the CVE record; 12.4.3-03670 / 12.5.0-03082 and prior per AV26-1017) — anything not on the build SonicWall released on 2026-10-06 under SNWLID-2026-0017 should be treated as vulnerable. Review Work Place interface access logs for unauthenticated requests to unexpected paths and for appliance-originated requests to internal services that no user session explains; investigate any such activity since 2026-10-06 as a possible compromise.
How to Patch
Apply the SMA1000 platform-hotfix SonicWall released on 2026-10-06 under SNWLID-2026-0017 for the 12.4.3 and 12.5.0 branches (the dossier does not give the fixed build numbers; take them from that advisory). Until the hotfix is applied, remove the Work Place interface from direct internet reachability.