Affected Systems
SonicWall SMA1000 models 6210, 7210, and 8200v. The vulnerability affects the Appliance WorkPlace interface. SMA 100 Series and SSL-VPN on SonicWall firewalls are NOT affected. Over 400 SMA1000 appliances exposed online per Shadowserver tracking.
Exploitation Status
Active exploitation confirmed. Previdian honeypot network detected exploitation attempts using crafted OPTIONS requests targeting the WorkPlace Extraweb interface to reach internal CouchDB service (127.0.0.1:5984) with admin:admin credentials. Exploitation began within 3 days of patch release on October 6, 2026.
Business Impact
Maximum severity SSRF vulnerability allows remote unauthenticated attackers to force the appliance to issue requests on their behalf, reach internal functionality, and perform unauthorized operations. SMA1000 gateways are high-value targets used by MSSPs, large enterprises, and government agencies for VPN access to internal applications and corporate networks. SonicWall has a history of zero-day exploitation—CISA has cataloged 19 exploited SonicWall vulnerabilities in 4 years, with 13 linked to ransomware operations. This is the third wave of SMA1000 zero-day exploitation in 2026 alone (July and September incidents preceded this).
Urgency
🔴 Immediate
Recommended Actions
- Immediately patch all SonicWall SMA1000 models 6210, 7210, and 8200v to the version released October 6, 2026 addressing CVE-2026-102255
- Audit logs for suspicious OPTIONS requests to the WorkPlace Extraweb interface, especially those targeting 127.0.0.1:5984 (CouchDB) or containing HTTP Basic Authorization headers
- Review authentication logs for admin:admin credential usage or other default/weak credentials on SMA1000 appliances
- Restrict external access to SMA1000 WorkPlace interfaces where possible; implement IP allowlisting for management interfaces
- Conduct forensic review of all SMA1000 appliances for indicators of compromise including custom malware (Sou5, OrangeTail, RootRun) associated with prior SMA1000 campaigns