SonicWall SMA1000 CVSS 10.0 Flaw Draws 135 Attempts From Two IP Addresses

An unauthenticated attacker who can reach the WorkPlace portal of a SonicWall SMA1000 appliance can make it send requests on the attacker's behalf and reach internal functions, and the flaw, CVE-2026-102255, carries a CVSS score of 10.0. Threat intelligence firm Previdian says it recorded 135 exploitation attempts from two IP addresses in the United States between Oct. 9 and Oct. 10.

The fix shipped before the attempts began. SonicWall's hotfix builds are 12.4.3-03670 and 12.5.0-03082, according to The Hacker News.

Which builds are affected

Previdian's CVE page lists the vulnerable range as the platform-hotfix builds below and anything older. The flaw is a pre-authentication server-side request forgery in the WorkPlace portal, caused by what Previdian calls an unintended alternate access path. It maps to CWE-918 and CWE-441.

Branch	Vulnerable at or below	Fixed in
12.4.3	12.4.3-03526	12.4.3-03670
12.5.0	12.5.0-02952	12.5.0-03082

The vendor advisory is SNWLID-2026-0017. The page returned only its title when this article was prepared, so the version table rests on Previdian and The Hacker News, not on SonicWall's own text.

The dates disagree

The sources do not line up, and the differences are small enough to matter for anyone checking logs.

• Sept. 28: Previdian says the CVE ID was reserved.
• Oct. 6: The Hacker News says the patches were released.
• Oct. 7: Previdian lists the advisory and CVE as published.
• Oct. 8: The Hacker News says Defused Cyber and Previdian first detected exploitation.
• Oct. 9: Previdian lists its first sensor hit and a virtual patch.
• Oct. 10: Previdian's last observation.

Previdian's own page is inconsistent about the first hit, showing 00:33 UTC in its timeline and 08:49 UTC in its source table. Defenders searching logs should start at Oct. 8 and work forward.

What 135 attempts does and does not mean

Previdian describes the data as one sensor, two unique attacker IP addresses, one country and one User-Agent string. It lists the CVE as absent from CISA's Known Exploited Vulnerabilities catalog, and The Hacker News reports that SonicWall had not yet revised its advisory. Neither Previdian nor The Hacker News reports a confirmed compromise of any appliance.

The score overstates what a defender can conclude and understates what an attacker is attempting. A 10.0 reflects network reach with no privileges and no user interaction. It does not say what the internal functions behind the SSRF expose, and neither source describes what the 135 requests asked for. Previdian gates request paths and payloads to paying tiers.

The June precedent on the same product

The Hacker News recalls two earlier flaws in SMA1000. CVE-2026-15409 (CVSS 10.0) and CVE-2026-15410 (CVSS 7.2) were exploited as zero-days in June by a threat actor tracked as UTA0533, who deployed Java web shells and a malware family called KNUCKLEBALL. Rapid7 reported that the attackers extracted credentials, session databases and TOTP MFA seed configurations before moving laterally.

That history is why an SSRF on this portal is worth patching quickly even before anyone publishes what it reaches. Remote access appliances are a recurring target, as the Palo Alto GlobalProtect case shows, where ransomware crews are still exploiting a flaw patched in May. A single leaked secret can also undo an otherwise hardened stack, as in the Google DevSite RCE.

What to do

Update to 12.4.3-03670 or 12.5.0-03082, and confirm whether the WorkPlace portal is reachable from the internet at all. Previdian lists virtual patches for AWS WAF, Cloudflare and ModSecurity for operators who cannot update at once, but the rule content is behind its Enterprise tier. Operators who ran the older builds after Oct. 7 should review WorkPlace portal logs from Oct. 8 onward, since the addresses and request paths Previdian recorded are behind its paid tiers.