SonicWall SMA1000 flaw targeted in exploitation attempts

Attackers are targeting a maximum-severity vulnerability in SonicWall SMA1000 appliances, according to a security researcher who spoke to BleepingComputer. SonicWall patched the flaw, tracked as CVE-2026-102255, in a Tuesday advisory.

The vulnerability affects the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. SonicWall says it does not affect the SMA 100 Series or SSL-VPN running on SonicWall firewalls. The company warned that a remote, unauthenticated attacker could potentially make an appliance issue requests on the attacker’s behalf, reach internal functionality, and perform unauthorized operations.

Ryan Dewhurst, founder of Previdian, told BleepingComputer on Friday that the company’s honeypot network had detected attempts consistent with exploitation. He described crafted OPTIONS requests targeting the WorkPlace Extraweb interface and attempting to reach the appliance’s internal CouchDB service at 127.0.0.1:5984. The activity included an HTTP Basic Authorization header with the credentials admin:admin.

Dewhurst said the activity was consistent with active exploitation attempts, but Previdian had not established whether any systems were successfully compromised. Shadowserver tracks more than 400 SMA1000 appliances exposed online; it is unclear how many are honeypots or have been patched.

SMA1000 gateways are used by managed service providers, corporations, and government agencies for remote access to internal apps and networks. The source also cites earlier SMA1000 vulnerabilities exploited in attacks, but does not establish a connection between those incidents and the current attempts.