Threat actors are actively exploiting a critical vulnerability affecting SonicWall SMA1000 secure remote access gateways, according to findings from security firm Previdian. The flaw, designated CVE-2026-102255, received a patch from SonicWall on Tuesday, but exploitation attempts have already been detected in the wild.
The vulnerability impacts the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. The SMA 100 Series product line and SSL-VPN implementations running on SonicWall firewalls remain unaffected by this particular flaw.
SonicWall's advisory describes the issue as follows: "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations."
Exploitation Details
Previdian founder and security researcher Ryan Dewhurst provided BleepingComputer with specifics about the attack pattern observed in the company's honeypot infrastructure. According to Dewhurst, "The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin."
Dewhurst noted that the WorkPlace interface had been targeted before through server-side request forgery (SSRF) vulnerabilities disclosed in July and September 2026. The current exploitation technique differs from those earlier attacks, though it targets the same interface.
While the observed activity aligns with genuine exploitation attempts, Dewhurst cautioned that Previdian has not yet determined "whether those attempts would have successfully compromised any systems."
Exposure and Risk
Internet threat monitoring organization Shadowserver has identified more than 400 SMA1000 appliances accessible from the internet. However, the actual number of vulnerable systems remains unclear, as this figure does not distinguish between honeypots, patched systems, and genuinely exposed infrastructure.
SMA1000 gateways represent high-value targets because they serve as critical access points for Managed Service Providers (MSSPs), large enterprises, and government organizations seeking to provide VPN connectivity to internal applications and corporate networks.
History of SMA1000 Exploitation
The SMA1000 platform has faced repeated exploitation campaigns. In July, attackers leveraged two zero-day vulnerabilities (CVE-2026-15409 and CVE-2026-15410) to deploy custom malware including Sou5, OrangeTail, and RootRun on vulnerable appliances. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) subsequently attributed some of these attacks to ransomware operations.
Last month, SonicWall disclosed that attackers were chaining two additional zero-day flaws (CVE-2026-83548 and CVE-2026-83549) in active campaigns to achieve remote code execution on SMA1000 gateways.
Over the past four years, CISA has cataloged 19 SonicWall vulnerabilities as actively exploited in the wild. Of these, 13 have been linked to ransomware gangs, underscoring the platform's prominence as a target for financially motivated threat actors.