Patched on Tuesday, Probed on Friday: CVE-2026-102255 and the SonicWall SMA1000 Exploitation Window

The patch shipped. The scanning started before the reboot finished.

SonicWall has confirmed that attackers are exploiting CVE-2026-102255, a maximum-severity flaw in its SMA1000 series secure remote access appliances. The vendor published a fix days before BleepingComputer reported live exploitation attempts on October 9, and the gap between those two events is, once again, where enterprises actually get breached.

The vulnerability sits in the Appliance WorkPlace interface on the SMA1000 6210, 7210, and 8200v models. It is a path traversal chained into server-side request forgery. In plain terms: an unauthenticated attacker on the internet can force the appliance to make requests on their behalf, reaching internal services that were never meant to answer the public.

What the exploitation attempts look like

Ryan Dewhurst, founder of the research firm Previdian, told BleepingComputer that his honeypot network caught requests consistent with the CVE-2026-102255 flaw. The technique is specific and ugly in its simplicity.

The attacker sends a crafted OPTIONS request at the WorkPlace Extraweb interface. That request is steered to the appliance’s internal CouchDB service at 127.0.0.1:5984. The payload then attempts to traverse into a CouchDB design document and invoke its _rewrite function. It arrives with an HTTP Basic Authorization header containing the credentials admin:admin.

Whoever wrote that exploit is not being subtle. They are kicking every door on the way in and hoping one was left unlocked and labelled with default credentials. Dewhurst was careful to note that Previdian has not established whether any of those attempts successfully compromised a system. That uncertainty cuts both ways: it means we do not know how many appliances fell, and it means nobody should wait for the answer to patch.

The WorkPlace interface keeps losing

This is not a one-off. The same WorkPlace interface was targeted by SSRF vulnerabilities disclosed in July and September 2026, and the October flaw uses a different exploitation technique against the same surface. Three interfaces-abuse flaws in one quarter on one product line is a code-quality story, not a luck story.

The July pair, CVE-2026-15409 and CVE-2026-15410, were abused for weeks to install custom Sou5, OrangeTail, and RootRun malware on vulnerable VPN appliances. CISA later linked some of those attacks to ransomware gangs. In September, SonicWall warned customers that attackers were chaining two more zero-days, CVE-2026-83548 and CVE-2026-83549, to execute remote code on SMA1000 gateways.

The running count tells the real story. Over the last four years CISA has added 19 SonicWall vulnerabilities to its catalog of actively exploited flaws. Thirteen of them were flagged as used by ransomware gangs.

Why an MSSP breach is your breach

SonicWall explains that SMA1000 devices are enterprise-grade secure remote access gateways, and they are targeted precisely because Managed Service Providers (MSSPs), many large corporations, and government agencies use them for VPN access to internal apps and corporate networks. Shadowserver now tracks more than 400 SMA1000 appliances exposed online, and there is no information on how many are honeypots or already patched against CVE-2026-102255 attacks.

For an MSSP, one unpatched SMA1000 is not one compromised device. It is a beachhead into every client network that appliance bridges. The blast radius is contractual, not just technical, and under POPIA a breach routed through your gateway into a client’s customer data is a breach you are jointly on the hook for.

What to do this week

1. Confirm whether you run SMA1000 6210, 7210, or 8200v appliances, and whether they are reachable from the internet. If you are a client of an MSSP, ask them directly and get the answer in writing.
2. Apply the vendor fix now. The advisory is out; the exploitation is confirmed; there is no responsible-disclosure clock left to respect.
3. Look at the management interface. If your appliance answers from a public IP, move it behind a gateway you control or restrict it to an administrative overlay.
4. Rotate any credentials the appliance could have touched, and treat default or leftover service accounts, the admin:admin class of thing, as hostile findings in a configuration audit.
5. Hunt for the July and September tradecraft too. Prior campaigns dropped Sou5, OrangeTail, and RootRun implants, so patching today does not prove you were never breached last month.

The eHawu view

CVE-2026-102255 is the third SMA1000 disclosure of the quarter, and each one followed the same shape: the internet-exposed management plane stays reachable, and the vendor eventually ships a fix after exploitation is visible. Patches close holes one at a time. The durable move is shrinking the surface an attacker can even probe.

eHawu sits at that network layer. We continuously map which of your appliances and interfaces face the public internet, flag the ones that should not, and give your team the evidence to pull them back before the next advisory becomes the next incident. If your SMA1000, or anything else with a login page on a public IP, is in scope this week, that is exactly the conversation to have now rather than after the post-mortem.