TL;DR: SonicWall shipped a fix on October 6 for a maximum severity flaw in its SMA 1000 remote access gateways. Attackers were probing for it within two days. More than 400 of these appliances still sit on the open internet.
Introduction
A maximum severity flaw in SonicWall remote access gateways is already drawing fire. Days after the vendor shipped a fix, honeypots lit up with attack traffic. The target is the box that guards the network’s front door.
From the open internet to a foothold
A server side request forgery flaw lets an outside request steer the appliance into talking to itself. No password. No user on the other end.
Three moves that end the chain
- Patch to the fixed WorkPlace build
- Take the portal off the public internet
- Replace every default credential
What Happened?
On October 6, SonicWall patched CVE-2026-102255, a server-side request forgery bug rated CVSS 10.0. It lives in the WorkPlace portal of SMA 1000 gateways, and a remote attacker needs no login to use it. Within two days, researchers watched probes land on their decoy appliances. The requests tried to reach an internal database service running on the box and sign in with a default password. This is the third flaw of its kind SonicWall has fixed in the same portal this year. The two earlier rounds were also reported under attack.
The Impact
These gateways sit at the edge of the network and hold the keys to everything behind them. More than 400 are still reachable from the open internet. One unpatched box can hand an intruder a foothold, then a path deeper in. Government, finance, and health care teams run them all.
SonicWall SMA 1000 SSRF: observed probe signature
These are the behavioral and network indicators published from honeypot activity. No attacker IP addresses have been released yet, so detection relies on the request pattern below. Treat these as hunting signatures, not a full host or network indicator set.
12.5.0-02952 and earlier
12.5.0-03082 and later
Affected models: SMA 1000 6210, 7210, 8200v. The SMA 100 series and SSL VPN on SonicWall firewalls are not affected. Vendor advisory: SNWLID-2026-0017. Detection tip: alert on OPTIONS requests to the WorkPlace portal that reference loopback addresses or CouchDB paths, and audit any appliance still using default internal credentials.
Why This Matters Now
Edge appliances have become the preferred entry point. They face the internet by design; they often run quietly for years, and a single unpatched gateway can undo every control behind it. A maximum severity score means the bar to abuse is as low as it goes: no password, no user interaction, just a crafted request.
When a fix ships for a bug like this, the clock starts for defenders and attackers at the same moment. This week’s scans show who tends to move first. The same portal has now been hit three times in a year. That pattern tells its own story about how hard these boxes are to keep shut. Each round gives attackers a fresh reason to scan every SonicWall gateway they can find.
How to Avoid This
- Patch now to the fixed WorkPlace build
- Pull admin portals off the public internet
- Watch logs for odd OPTIONS requests
- Replace every default credential
- Treat any exposed gateway as already probed
Know your exposed edge before someone else maps it
Attackers find internet-facing gateways with a quick scan. Most teams find out after the alerts fire. Governed AI teammates from Secure.com close that gap, inside the limits your team sets.
- The Red Teammate maps your internet-facing assets and tests what an attacker could actually reach
- It checks whether a flaw like this is exploitable in your setup, not just present on a scan
- The Cloud Security Teammate flags exposed gateways and default credentials, then opens a governed fix
- The SOC Teammate matches probe traffic against your logs and escalates the real hits
- Every action waits for your approval, with a full record of what was done and why