Affected Systems

SonicWall SMA1000 series appliances: models 6210, 7210, and 8200v. The vulnerability (CVE-2026-102255) affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected. Approximately 400+ Internet-exposed SMA1000 appliances identified by Shadowserver.

Exploitation Status

Not currently exploited in the wild according to SonicWall. However, SMA1000 appliances have been targeted in multiple zero-day campaigns in 2026, including ransomware attacks. CISA has cataloged 19 exploited SonicWall vulnerabilities in the past four years, 13 linked to ransomware.

Business Impact

Critical risk to organizations using SMA1000 gateways for remote access. The SSRF vulnerability allows unauthenticated remote attackers to abuse an alternate access path with low complexity, forcing the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations. High-value target for threat actors due to deployment in government agencies, MSSPs, and large enterprises. Given the history of SMA1000 zero-day exploitation (including recent July and September 2026 incidents), rapid exploitation is likely once details become public.

Urgency

🔴 Immediate

Recommended Actions

  • Immediately apply SonicWall hotfixes released October 7, 2026 for SMA1000 models 6210, 7210, and 8200v
  • Verify that SMA1000 appliances are not directly exposed to the Internet; place behind firewall with restricted access if possible
  • Review SMA1000 access logs for unusual requests to the Appliance WorkPlace interface, particularly from unauthenticated sources
  • Monitor for indicators of compromise associated with Sou5, OrangeTail, and RootRun malware families previously used against SMA1000 devices
  • If immediate patching is not feasible, implement network-level controls to restrict access to the Appliance WorkPlace interface to trusted IP ranges only