Honeypots log exploitation attempts against SonicWall SMA1000 flaw three days after patch
Attackers began targeting SonicWall's maximum-severity SMA1000 flaw CVE-2026-102255 within three days of its patch, Previdian's honeypots show. SonicWall's advisory had not called it exploited by Friday, so owners waiting on that label are patching behind the attackers.
The Watch · Security desk
Shadowserver tracks more than 400 SMA1000 appliances exposed online, with no information on how many are honeypots or already patched. CISA added 19 SonicWall vulnerabilities to its exploited catalog over the last four years, flagging 13 as used by ransomware gangs, about 68 percent.
| Figure | Value | Note | Claim |
|---|---|---|---|
| SMA1000 appliances exposed online, more than | 400 appliances | honeypot and patched counts unknown | 13 |
| SonicWall flaws CISA added as exploited, four years | 19 vulnerabilities | 13 flagged as used by ransomware gangs | 12 |
| Used by ransomware gangs | 68% about | 15 |
What happened
- The flaw sits in the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models; the SMA 100 Series and SSL-VPN on SonicWall firewalls are not affected.
- Previdian has not yet established whether any of the logged attempts would have compromised a real system.
- Shadowserver tracks more than 400 SMA1000 appliances exposed online, a figure that includes an unknown number of honeypots and patched units.
- CVE-2026-102255 is the fifth SMA1000 flaw attackers have gone after since July, spread across three separate rounds.
Why it matters
- Who has to decide decision Attempts arrived three days after the fix shipped, so an SMA1000 owner on a monthly change window would leave the gateway open for weeks after attackers showed up.
- Who's exposed exposure Because these gateways front VPN access for MSSPs, large companies and government agencies, a working request-forgery path exposes internal services at those organisations to an outsider with no credentials.
- What it sets up precedent July's SMA1000 zero-days ended up in intrusions CISA linked to ransomware gangs; a reliable exploit for this bug would be expected to travel the same way.
Next story · Security · Oct 7
SonicWall patches a third pre-auth SSRF flaw in SMA 1000 gateways this yearConfirmed4 publishers
The traffic Previdian logged is a server-side request forgery aimed at a database that should only answer to the appliance itself [8][2]. "The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin," Dewhurst told BleepingComputer [4].
The attacker needs no login on the gateway. SonicWall said a remote unauthenticated attacker could use the flaw to "direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations" [8]. In Previdian's capture, the request is aimed at the appliance's own loopback address, where CouchDB listens on port 5984 [4]. The payload then reaches for a design document's _rewrite function and offers admin:admin, a default-style login, to the internal database [4].
The WorkPlace code has been hit before. Dewhurst said the bug "affects the same WorkPlace interface targeted by earlier SSRF vulnerabilities disclosed in July and September 2026," though the October flaw uses a different exploitation technique [5]. In July, attackers used two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, for weeks to install Sou5, OrangeTail and RootRun malware [9]. Last month, SonicWall warned that attackers were chaining CVE-2026-83548 and CVE-2026-83549 in the wild to run code on SMA1000 gateways [11].
That makes three rounds against SMA1000 since July [16]. Previdian described the requests and the payload but not who sent them, so whether one crew is behind all three rounds is not public [2][4].
SonicWall flaws that reach CISA's list tend to end up with ransomware crews [15]. In the past four years, 19 SonicWall bugs have gone into CISA's exploited-vulnerabilities catalog, and the agency flagged 13 of them, about 68 percent, as used by ransomware gangs [12][15].
What to watch
- SonicWall revising its CVE-2026-102255 advisory to mark the flaw actively exploited, or CISA adding it to its exploited-vulnerabilities catalog.
- Confirmation from Previdian or an incident responder that the CouchDB _rewrite request compromised a production SMA1000 appliance.
- Shadowserver figures showing how many of the 400-plus exposed SMA1000 appliances still run unpatched builds.
Clarity's read
What the record supports and how the coverage leans. The claims behind it follow.
Reality
- Evidence66
- Adoption25
- Hype gap+28
- Incentives40
- Confidence72
Perspective Coverage
7 publishers- Builder
- Builder 17%
- Operator
- Operator 77%
- Investor
- Investor 6%
Claim ledger
Ranked by verification strength, evidence, and original report placement.
- [1]
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances, CVE-2026-102255, which was patched on Tuesday, three days before BleepingComputer's Friday report.
- [2]
Ryan Dewhurst, founder of Previdian, told BleepingComputer on Friday that Previdian's honeypot network detected exploitation attempts consistent with CVE-2026-102255.
- [3]
SonicWall had not flagged CVE-2026-102255 as actively exploited in its Tuesday advisory as of BleepingComputer's Friday report.
- [4]
"The requests targeted the WorkPlace Extraweb interface, using a crafted OPTIONS request to reach the appliance's internal CouchDB service at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin,"
- [5]
"It affects the same WorkPlace interface targeted by earlier SSRF vulnerabilities disclosed in July and September 2026." Dewhurst added that the October vulnerability uses a different exploitation technique.
- [6]
Dewhurst said the activity is consistent with active exploitation attempts, but Previdian has not yet established "whether those attempts would have successfully compromised any systems."
- [7]
CVE-2026-102255 affects the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models and does not affect the SMA 100 Series or SSL-VPN running on SonicWall firewalls.
- [8]
"By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations,"
- [9]
In July, threat actors abused two SMA1000 zero-days, CVE-2026-15409 and CVE-2026-15410, for weeks to install custom Sou5, OrangeTail and RootRun malware on vulnerable VPN appliances.
- [10]
CISA later linked some of the July SMA1000 attacks to ransomware gangs.
- [11]
Last month, SonicWall warned customers that attackers were chaining two zero-days, CVE-2026-83548 and CVE-2026-83549, in the wild to execute remote code on vulnerable SMA1000 gateways.
- [12]
Over the last four years, CISA has added 19 SonicWall vulnerabilities to its catalog of actively exploited flaws, flagging 13 of them as used by ransomware gangs.
- [13]
Shadowserver tracks more than 400 SMA1000 appliances exposed online; there is no information on how many are honeypots or already patched against CVE-2026-102255.
- [14]
SMA1000 secure remote access gateways are often targeted because MSSPs, many large corporations and government agencies use them for VPN access to internal apps and corporate networks.
- [15]
About 68 percent of SonicWall flaws in CISA's exploited catalog were flagged as used by ransomware gangs.
- [16]
CVE-2026-102255 is the fifth SMA1000 CVE attackers have targeted since July, across three separate rounds.
Sources
7 independent publishers whose own reporting we read for this story.
- bleepingcomputer.comMax severity SonicWall SMA1000 flaw now exploited in attacks
1 article · October 9, 2026
- dev.toSonicWall SMA1000 CVE-2026-102255: SSRF Attack Attempts Targeting Internal CouchDB
1 article · October 9, 2026
- CVE-2026-102255 Exploitation Observed — SMA1000 | Previdian
previdian.com
1 article · October 7, 2026
- scworld.comSonicWall SSRF bug rated 10.0 exploited in SMA1000 Appliance Work Place
1 article · October 9, 2026
- securityaffairs.comSonicWall Patches CVSS 10.0 SSRF Flaw as Attacks Begin
1 article · October 12, 2026
- securityweek.comCritical SonicWall Vulnerability Exploited Days After Disclosure
1 article · October 12, 2026
- thehackernews.comCritical SonicWall SMA 1000 Flaw Targeted in 135 Exploitation Attempts After Patch
1 article · October 12, 2026
Topics and entities
Topics
- Vulnerability Exploitation
- Server-Side Request Forgery
- Edge appliance and gateway security
- VPN and remote access security