Exploitation attempts against CVE-2026-102255, the CVSS 10 pre-auth SSRF in SonicWall SMA1000 WorkPlace that we covered when the patch shipped, are now showing up in honeypots. If you haven't applied the hotfix yet, it is no longer a routine patch. Treat it as an emergency.
What happened
BleepingComputer reported on October 9 that Previdian founder Ryan Dewhurst told the outlet the company's honeypot network had detected exploitation attempts consistent with CVE-2026-102255. That was three days after SonicWall's Tuesday, October 6 advisory (SNWLID-2026-0017).
According to Dewhurst's description, as reported by BleepingComputer, the requests:
- targeted the WorkPlace Extraweb interface using a crafted HTTP
OPTIONSrequest; - aimed to reach the appliance's internal CouchDB service at
127.0.0.1:5984; - tried to traverse into a CouchDB design document and invoke its
_rewritefunction; - carried an HTTP Basic Authorization header with the credentials
admin:admin.
There are two caveats. BleepingComputer notes that Previdian has not yet established whether those attempts would have compromised anything. And SonicWall's advisory had not been updated to flag active exploitation at the time of the report. BleepingComputer also cites Shadowserver data showing more than 400 SMA1000 appliances exposed online, but notes it is unclear how many are honeypots or already patched. As of CISA's October 8 catalog release, CVE-2026-102255 was not listed in the Known Exploited Vulnerabilities catalog.
On timing, BleepingComputer says the flaw was patched on Tuesday and that Dewhurst spoke to it on Friday. That puts the patch on October 6 and the honeypot report on October 9, which matches our original coverage. We could not retrieve Previdian's own post on X to confirm its details directly.
Why it matters
The gap between patch and probing was about three days. That fits the pattern: the July and September SMA1000 WorkPlace SSRF pairs were both exploited, and CISA has added 19 SonicWall flaws to KEV over four years, 13 of them linked to ransomware according to BleepingComputer.
The payload also shows what attackers are after. The SSRF isn't the end goal. It's a way to reach internal services that were never meant to face the internet, such as CouchDB on loopback, while trying default-looking credentials on the way through. On a remote access gateway, that internal state sits next to user sessions and access policy. A successful chain there is an identity-plane compromise, not just a network-device bug. Note that the admin:admin header is what the attackers sent. Neither source says SMA1000 actually uses those credentials.
What to check in your environment
- Confirm the full build number on every SMA1000 6210, 7210 and 8200v, including DR and lab units. Fixed builds are 12.4.3-03670 and 12.5.0-03082 or later. Anything below that should be patched today.
- Search WorkPlace and upstream proxy/WAF logs from October 6 onward for
OPTIONSrequests to the Extraweb path that reference127.0.0.1:5984, CouchDB design documents, or_rewrite, and for Basic auth headers you didn't expect. - If you find matching requests against an unpatched appliance, open an investigation instead of just patching. In CSO Online's analysis, Frank Dickson notes that SonicWall's guidance after earlier incidents was to re-image, rotate passwords and reset TOTP seeds, and that this advice still stands.
- Reduce exposure. Keep the management console off the internet. Restrict WorkPlace to the users and networks that need it where your deployment allows.
- Re-check the July and September releases. An appliance that missed those patches has a longer exposure history and needs a compromise review.
- Watch SonicWall PSIRT advisory SNWLID-2026-0017 and CISA KEV for a change in exploitation status, and name an owner to act on it.