Maximum-Severity SSRF Flaw in SonicWall SMA Devices Under Attack

Attackers are already probing a perfect-10 CVSS vulnerability in SonicWall's SMA 1000 Secure Mobile Access gateway, despite the vendor's claim of no confirmed in-the-wild exploitation. The flaw, CVE-2026-102255, is a server-side request forgery bug in the appliance's WorkPlace remote-access portal, caused by an unexpected alternate access route that lets an unauthenticated attacker force the device to make requests on their behalf and reach internal systems. Honeypot operators Previdian and Defused reported seeing unauthenticated SSRF probing against SonicWall SMA decoys within days of SonicWall's October 6 advisory, and researchers at SOCRadar warn the device's internet-facing position could let intruders pivot into normally unreachable internal services. SonicWall has published three other CVEs alongside this one and released a hotfix, urging SMA 1000 customers to patch immediately, while noting that SMA 100 devices and firewall-based SSL-VPNs are not impacted.