Attackers are exploiting a critical SMA1000 flaw to make remote-access appliances reach internal services without authentication. GajIPS detects the exploitation attempts
Severity: Critical | Priority: 1
This GajIPS update adds detection for active exploitation of CVE-2026-102255, a maximum-severity server-side request forgery (SSRF) vulnerability in SonicWall SMA1000 secure remote access appliances. The flaw is in the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models. It does not affect the SMA 100 series or the SSL-VPN on SonicWall firewalls.
An attacker who has not logged in can make the appliance send requests on their behalf, reach its internal functions and perform actions they should not be allowed to. SonicWall released a fix on October 6, 2026. Within three days, honeypots recorded exploitation attempts. The attempts sent crafted OPTIONS requests to the WorkPlace interface to reach the appliance's internal CouchDB database, call a CouchDB function, and log in with the default admin:admin credentials.
SMA1000 appliances are a frequent target because enterprises, government agencies and managed service providers rely on them for remote access to internal networks. Two earlier SMA1000 zero-days, in July 2026, were exploited to install custom malware, and CISA later linked some of those attacks to ransomware gangs. Further SMA1000 zero-days were exploited in September.
If these alerts trigger in your network, an attacker is trying to exploit your SMA1000 appliance. Check whether it is running a release that fixes CVE-2026-102255 (see SonicWall advisory SNWLID-2026-0017). If it was not patched when the alerts fired, treat it as potentially compromised:
Apply SonicWall's fixed release immediately. Restrict access to the management interface to trusted networks, and change any default credentials on the appliance.