SonicWall has warned customers about a critical pre-authentication vulnerability in its SMA1000 series secure access appliances, rated CVSS 10.0. Advisory SNWLID-2026-0017 was issued on 6 October 2026, and patching is presented as the only fix, with no workaround available.

How the flaw works

The vulnerability, tracked as CVE-2026-102255, is a server-side request forgery flaw in the WorkPlace interface of the SMA1000 appliances. An unauthenticated remote attacker can force an appliance to issue attacker-chosen requests that reach internal functionality. Because no authentication is required, exposed appliances face particular risk if they remain unpatched, especially where they provide remote access into an organisation's network.

Exploitation attempts already seen

Honeypot telemetry recorded real exploitation attempts within roughly 24 hours of disclosure, showing how quickly attackers moved after the advisory appeared. It is the third pre-authentication SSRF flaw in the same WorkPlace interface this year, and the previous two were also exploited in the wild. That history is important because it shows a repeated pattern in the same interface, rather than an isolated weakness, and it helps explain why the latest advisory has drawn urgent attention. Organisations using SMA1000 appliances should therefore patch without delay, confirm the patched version after installation, and review whether any appliance was left exposed while unpatched. Secure access appliances sit at the boundary of a network, so a flaw there can matter more than a flaw in an internal tool. Advisory SNWLID-2026-0017 makes clear that patching is the only fix, and no workaround should be relied on instead. The advisory was issued on 6 October 2026 for the SMA1000 series. No exploit instructions or proof-of-concept detail are included here.

Sources: SonicWall advisory (via analysis)