Max severity SonicWall SMA1000 flaw now exploited in attacks

A maximum-severity SSRF vulnerability in SonicWall SMA1000 appliances, CVE-2026-102255, is already being targeted by attackers just three days after a patch was issued. The bug sits in the Appliance WorkPlace interface of the SMA1000 6210, 7210 and 8200v models and lets an unauthenticated remote attacker force the device to make requests on their behalf, reaching internal services and performing unauthorized actions; SMA 100 series devices and firewall SSL-VPN are not affected. Security researcher Ryan Dewhurst of Previdian reported honeypot traffic matching this flaw, with crafted OPTIONS requests hitting the appliance's local CouchDB instance and trying to invoke an internal rewrite function using default admin:admin credentials, though it's unclear if any attempts actually succeeded. This follows a pattern of repeated SMA1000 zero-day abuse this year, including custom malware deployments and ransomware-linked intrusions tied to other CVEs, with Shadowserver counting over 400 SMA1000 devices currently exposed online.