SonicWall users are currently facing a significant threat as cyber attackers exploit a critical vulnerability in the Secure Mobile Access (SMA) 1000 appliance. This server-side request forgery (SSRF) flaw, identified as CVE-2026-102255, has been assigned a maximum severity score of 10 out of 10 by SonicWall. The vulnerability is located in the WorkPlace interface, a web-based portal that facilitates remote user access. According to SonicWall, this flaw could allow an unauthenticated attacker to send unauthorized requests, potentially granting access to internal functions.
Reports of exploitation emerged shortly after SonicWall's advisory on October 6. Two cybersecurity firms, Previdian and Defused, detected suspicious activity targeting this flaw on their honeypot systems. Despite these reports, SonicWall stated there is no confirmed evidence of the flaw being exploited in real-world scenarios. However, the high CVSS score implies the vulnerability might be easily exploitable.
The SMA appliance is pivotal for providing SSL VPN, clientless remote access, and zero-trust network access to corporate resources. The critical nature of the WorkPlace interface, which links public internet access to corporate and internal network services, makes it a prime target for cybercriminals. SOCRadar researchers have highlighted the risk this poses, as the interface could potentially be exploited to reach services not meant for external access.
In response, SonicWall has issued a hotfix and strongly advises all customers to apply it immediately. They confirmed that other products, like the SMA 100 Series and SSL-VPNs on SonicWall firewalls, are not affected by this vulnerability. The incident underscores the ongoing threat landscape for SonicWall customers, who have previously faced attacks, including incidents involving the Inc ransomware group earlier this year.
Edge devices, like SSL-VPNs, remain common targets for cyber threats due to their vulnerability. Cyber insurer Coalition notes that these devices' risks are reflected in insurance premiums, which are influenced by the security posture and claims history of the technology used by clients. Coalition's Joe Toomey recommends transitioning to zero-trust solutions to mitigate risks associated with legacy SSL-VPN devices.
