Defused decoys logged exploit attempts on SonicWall's CVSS 10.0 SMA1000 flaw two days after disclosure
Defused researchers say first exploitation attempts reached their decoys on 8 October, two days after SonicWall disclosed its CVSS 10.0 SMA1000 flaw. The advisory, last updated 6 October, still says there is no evidence of exploitation.
The Engineer · Build desk
Ranking of the four SonicWall flaws by rating: pre-authentication SSRF in the SMA1000 Work Place interface 10.0; post-authentication OS command injection 7.8; Zip Slip path traversal in the Appliance Management Console 7.2; stored cross-site scripting 5.5.
Rating of each flaw in SonicWall's 6 October advisory In rating
| Rank | Item | Value | Claim |
|---|---|---|---|
| 1 | Pre-auth SSRF, Work Place | 10 rating | 5 |
| 2 | Post-auth OS command injection | 7.8 rating | 8 |
| 3 | Zip Slip path traversal | 7.2 rating | 8 |
| 4 | Stored cross-site scripting | 5.5 rating | 8 |
What happened
- SonicWall's advisory SNWLID-2026-0017 covers four flaws, and the top one, CVE-2026-102255, is a pre-authentication server-side request forgery in the SMA1000 Work Place interface.
- Models 6210, 7210 and 8200v are affected on 12.4.3-03526 or older and on 12.5.0-02952 or older, with fixes in 12.4.3-03670 and 12.5.0-03082 and higher.
- Beazley Security says attackers exploited earlier SSRF flaws in the same Work Place interface as zero-days, disclosed by SonicWall in July and again in September.
Why it matters
- Who has to decide decision Owners who installed 12.5.0-02952, the September fix, are on an affected build and need a second upgrade on the same interface.
- What it limits constraint The advisory's workaround field reads none, so an owner who cannot patch at once has no vendor-listed stopgap.
- What doesn't add up contradiction SonicWall's no-evidence line speaks to what it knows about customer appliances, while the decoy logs show attackers trying. Neither source shows a production appliance was compromised.
SonicWall labels CVE-2026-102255 both an SSRF and an unintended-proxy flaw, the CWE-441 confused-deputy pattern [7]. The cause is an unintended alternate access path, and the result is an appliance that forwards the attacker's requests [7]. Placement matters here. SMA1000 units sit at the network edge so that staff and partners can reach internal systems from outside [4]. In our view, a forward proxy on that box inherits the box's reach into the internal network.
The port is the new information. According to the DEV Community write-up, the payload captured by a research honeypot aimed a request at a local service on port 5984 [18]. The write-up does not say what listens on that port or whether a stock SMA1000 exposes anything there. A decoy shows what the attacker asked for, not what a real appliance would have answered. For the observation to transfer, a real service would have to sit on that port and the SSRF would have to reach it. We would not assume either.
We would still read the payload as intent, since someone wrote a request with a specific internal target within two days of disclosure [c3, c5]. That is a reason to patch sooner. The fix itself is unchanged.
No proof-of-concept is known, and SonicWall has published no technical detail beyond the advisory text [14]. The advisory page was captured on 13 October, five days after the first decoy hits, with its last-updated date still at 6 October [c17, d2].
The Work Place interface has now produced three rounds of urgent patching in 2026 [15]. CISA listed the two September flaws in its Known Exploited Vulnerabilities catalogue on 2 September [12], and this advisory arrived 34 days later [17].
Scope is narrow. SonicWall says SSL-VPN on its firewall products is not affected, and Help Net Security reports the SMA 100 series is not either [10]. The other three flaws in the advisory carry ratings of 7.8, 7.2 and 5.5 and a higher bar for an attacker [8].
What to watch
- Whether SonicWall revises the advisory's exploitation status, which was last updated on 6 October.
- Whether Defused or anyone else publishes the payload and says what listens on port 5984 on a real SMA1000.
- Whether CISA adds CVE-2026-102255 to its Known Exploited Vulnerabilities catalogue, as it did for the September pair.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence62
- Adoption
- Not scored
- Hype gap+8
- Incentives
- Not scored
- Confidence60
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Researchers at Defused reported that the first exploitation attempts reached their decoys on 8 October, two days after disclosure.
- [2]
SonicWall's advisory, last updated on 6 October, states there is currently no evidence any of the four flaws are being exploited in the wild.
- [3]
The advisory page, with a publication and last-updated date of 6 October 2026, was captured on 13 October 2026.
- [4]
SonicWall's SMA1000 is a line of remote access appliances that organisations place at the network edge so that staff and partners can reach internal systems from outside the network.
- [5]
SonicWall published advisory SNWLID-2026-0017 on 6 October 2026 covering four flaws, the highest rated being CVE-2026-102255, a pre-authentication server-side request forgery in the SMA1000 Work Place interface with a CVSS v3 score of 10.0.
- [6]
The advisory's workaround field reads none.
- [7]
CVE-2026-102255 is caused by an unintended alternate access path; SonicWall classifies it as both an SSRF and an unintended-proxy flaw, the CWE-441 confused-deputy pattern, in which the appliance is convinced to act as a forward proxy for the attacker's requests.
- [8]
The other three flaws carry lower ratings and a higher bar for an attacker: CVE-2026-102256 is a post-authentication OS command injection rated 7.8, CVE-2026-102257 is a Zip Slip path traversal in the Appliance Management Console rated 7.2, and CVE-2026-102258 is a stored cross-site scripting flaw rated 5.5.
- [9]
Affected are models 6210, 7210 and 8200v running platform hotfix 12.4.3-03526 or older, and the same models on 12.5.0-02952 or older; fixed hotfixes are 12.4.3-03670 and 12.5.0-03082 and higher, available through MySonicWall.
- [10]
SonicWall states that SSL-VPN running on its firewall products is not affected, and Help Net Security reports that the SMA 100 series is not affected either.
- [11]
According to Beazley Security's advisory, threat actors exploited earlier SSRF flaws in the same Work Place interface as zero-days, disclosed by SonicWall in July and again in September 2026.
- [12]
The September round covered CVE-2026-83548, a pre-authentication SSRF, and CVE-2026-83549, a post-authentication OS command injection; CISA added both to its Known Exploited Vulnerabilities catalogue on 2 September 2026, and attackers chained them to reach unauthenticated remote code execution.
- [13]
The 12.5.0 build that fixed the September flaws is listed as affected in this advisory, and Beazley states that organisations which installed 12.5.0-02952 must upgrade again.
- [14]
SonicWall has published no technical detail beyond the advisory text and no proof-of-concept is known.
- [15]
The Work Place interface has now produced three rounds of urgent patching in the same year.
- [16]
The advisory page capture of 13 October came five days after the first decoy hits on 8 October.
- [17]
CISA listed the September flaws on 2 September 2026; the October advisory came 34 days later.
- [18]
A research honeypot captured a payload that aimed a request at a local service on port 5984.
Get this ledger inside ChatGPT. Ask about any of our stories and the answer brings its figure, each claim’s verdict and the sources. Free, no account.
Sources
1 independent publisher whose own reporting we read for this story.
- dev.toSonicWall's SMA1000 SSRF Reached Security Decoys Two Days After the Patch
1 article · October 16, 2026
Topics and entities
Follow any of these and your For You feed starts watching them — no settings page required.
Topics
- Server-Side Request ForgeryFollow
- Edge and Perimeter Appliance VulnerabilitiesFollow
- In-the-Wild Vulnerability ExploitationFollow
- Patch And Redeploy LatencyFollow