SonicWall SMA1000: Pre-authentication SSRF in Appliance WorkPlace

Summary

SonicWall SMA 1000 appliances on the listed platform-hotfix builds contain a pre-authentication Server-Side Request Forgery (SSRF) flaw in the Appliance WorkPlace interface. It is caused by an unintended alternate access path. A remote, unauthenticated attacker could make the appliance send requests on their behalf, potentially reaching internal systems and performing unauthorized operations. No authentication or user interaction is required, and the CVSS v3.1 base score is 10.0 (Critical).

Affected

• SonicWall SMA 1000 series (SMA 6210, 7210 and 8200v, physical and virtual), platform-hotfix 12.4.3-03526 and older
• SonicWall SMA 1000 series, platform-hotfix 12.5.0-02952 and older
• Older builds not enumerated; check MySonicWall for the full list

Fixed in

• Platform-hotfix 12.4.3-03670 and higher (per secondary sources, verify with the advisory)
• Platform-hotfix 12.5.0-03082 and higher (also in SonicWall's product notice)
• Hotfixes are available via the MySonicWall portal

Workaround

• None listed by SonicWall. The patch is the only vendor remediation.
• Not vendor-sourced: restrict which networks can reach the WorkPlace portal and review logs for unusual request patterns until patched.

Exploitation

• SonicWall: no evidence of exploitation in the wild.
• Honeypot operators reported exploitation attempts against decoy appliances; successful compromise is unconfirmed.
• One vendor-independent report claims active exploitation since October 2026; this is unverified.
• Not listed in CISA KEV according to secondary checks; not verified directly.
• No public PoC detected for this CVE.

Our recommendation

• Identify all SMA 1000 appliances and their platform-hotfix build numbers.
• Apply the fixed platform-hotfix builds from MySonicWall as soon as possible, and verify the versions after patching.
• Until patched, restrict access to the WorkPlace portal to trusted networks.
• Review logs for unusual requests to the WorkPlace portal and check for signs of internal access.
• Note that affected builds were also exposed to earlier pre-authentication SSRF issues; treat unpatched systems as high risk.

Public exploits iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).

Links to third-party sites, not checked by us – exploit code can contain malware. Only use it in isolated test environments.

• Proof of concept on GitHub (3 repositories) iAttack code is publicly available (PoC on GitHub, Metasploit or Exploit-DB).
  HORKimhab/CVE-2026-102255 · techupdate24/sonicwall-sma-1000-cve-2026-102255 · CompleteTech-Security/sonicwall-sma1000-cve-2026-102255-check

Research sources

• SonicWall PSIRT advisory SNWLID-2026-0017 psirt.global.sonicwall.com
• SonicWall product notice for SMA 1000 series www.sonicwall.com
• Help Net Security: SonicWall fixes pre-auth SSRF flaw in SMA 1000 www.helpnetsecurity.com
• The Hacker News: SonicWall patches CVSS 10.0 pre-auth flaw thehackernews.com
• BleepingComputer: SonicWall warns of max-severity SSRF flaw www.bleepingcomputer.com
• GBHackers: SonicWall fixes 4 SMA 1000 vulnerabilities gbhackers.com
• Ionix threat center: CVE-2026-102255 www.ionix.io
• The Hacker Wire: CVE-2026-102255 www.thehackerwire.com

Researched and written up in English and German by an AI (Claude by Anthropic) based on NVD, CISA, EPSS and the sources listed. The vendor information is authoritative. Researched on 30 Oct 2026, 14:34.