SonicWall SMA1000 CVE-2026-102255: September's fix is now a target

If you patched your SonicWall SMA1000 in September and called it done, you are on a vulnerable build again. SonicWall shipped hotfixes on October 6 for CVE-2026-102255, a CVSS 10.0 pre-authentication SSRF in the same WorkPlace interface that was hit in July and September. By October 8, honeypots were logging exploit attempts. This is the third SSRF in that interface this year. The SMA1000 CVE-2026-102255 patch is a same-week job, and the pattern behind it is the real story.

What actually happened

Per Help Net Security, SonicWall's advisory SNWLID-2026-0017 covers four bugs on SMA1000 models 6210, 7210, and 8200v, physical and virtual:

• CVE-2026-102255 — pre-auth server-side request forgery in the Appliance WorkPlace interface. An unauthenticated attacker can make the appliance send requests on their behalf. Singapore's Cyber Security Agency lists it at CVSS 10.0.
• CVE-2026-102256 — post-auth OS command injection.
• CVE-2026-102257 and CVE-2026-102258 — path traversal and XSS in the management console, both admin-only.

Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later. CSA lists 12.4.3-03526 and 12.5.0-02952 and older as affected. Those are the exact builds that fixed September's zero-days.

SonicWall's advisory said it had no evidence of exploitation. Two days later, BleepingComputer reported that researcher Ryan Dewhurst's honeypots caught crafted OPTIONS requests through the WorkPlace interface. The requests tried to reach the appliance's internal CouchDB service on 127.0.0.1:5984 with default admin credentials. Defused also saw unauthenticated SSRF traffic against its decoys. Nobody has confirmed a successful compromise yet. Shadowserver tracks 400+ exposed SMA1000 appliances.

Why it matters for your business

Look at the shape of this bug. A pre-auth SSRF gets an attacker inside the box. A post-auth command injection turns that access into code execution. That is the same pair SonicWall shipped in September, which we covered then. Nobody has shown a working chain this time. We would not wait for the proof of concept.

Three moves:

Patch to 03670 or 03082 this week. "We patched in September" is the wrong answer now. Check the actual build string on the appliance, not the ticket that says it was done.

Count the SSRFs. Three in one interface in four months means the WorkPlace portal is the attack surface, not a single bad line of code. If your team uses only the tunnel, ask whether the web portal needs to face the internet at all.

Price the next one. A remote-access box that needs an emergency patch every five or six weeks costs someone's evening each time. Put that labor next to the license renewal when you compare vendors.

Sources: Help Net Security, BleepingComputer, CSA Singapore AL-2026-137.