SonicWall disclosed CVE-2026-102255 on October 6, 2026. The flaw is an unauthenticated server-side request forgery (SSRF) vulnerability in the SonicWall Work Place interface of the SMA1000 appliance and carries the maximum CVSS score of 10.0. SonicWall describes it as an unintended alternate access path that lets a remote attacker direct the appliance to issue requests on their behalf and reach internal functionality. The affected models are the 6210, 7210, and 8200v running version 12.4.3-03526 and 12.5.0-02952 and earlier. A patch has been released by SonicWall and updating to 12.4.3-03670 or 12.5.0-03082 or newer resolves this issue.
Attackers did not wait long before attempting to exploit this vulnerability. Defused reported that the first exploitation attempts reached its SMA decoys on October 8, two days after disclosure. Previdian said its sensors were also seeing attempts consistent with the CVE, Finally, Horizon3.ai warned that successful exploitation could allow attackers to take over vulnerable devices. However, SecurityWeek’s coverage has not confirmed any successful compromise.
What SSRF Means in Plain Language
Think of the appliance as a receptionist who can reach every internal office. A visitor at the front desk should only get what the public is allowed to see. With an SSRF flaw, the visitor can ask the receptionist to place calls on their behalf, and the receptionist does just that. The calls would come from an internal trusted extensions and the caller and the attacker needs no special access to the building. The appliance does the work and brings along the trust that internal services place in it.
Why Edge Appliances Are Prime Targets
Remote access gateways exist to connect the outside world to internal resources, so they are reachable from the internet by design. They also tend to hold privileged connections to the networks behind them. Compromising one device could give you initial access to an organizations network without needing to send a single phish, steal any passwords, or access a single building.
Attackers know this and make a practice of watching for advisories like this one. A critical edge vulnerability gives them a short list of internet-facing targets and a known weakness to test against each of them. We see the same pattern on external penetration tests: the internet-facing systems that organizations forget about are often the ones with the most direct path inward.
Why Patching Windows Must Shorten
As it stated above, it took two days between disclosure and the first reported attempts. A monthly patch cycle assumes that attackers need weeks to build and aim an exploit, and this timeline shows that assumption no longer holds for critical flaws on internet-facing devices. If your process treats a CVSS 10.0 gateway flaw like any other update, the exposure window is yours to close. That said, the shorter the window, the better.
Start with an accurate inventory of every internet-facing appliance in the organization, including the ones a department bought on its own and the one protecting a warehouse in the middle of nowhere. Give critical edge appliance advisories a separate emergency path with a clear owner and a target measured in hours. Confirm the fixed version against SonicWall’s advisory before you deploy, and review logs for unusual requests to the appliance covering the days before you patched, since attempts began soon after disclosure.
How Raxis Can Help
Our external network penetration testing approaches your perimeter the way an attacker would. Our testers find the appliances and services you expose and check them for weaknesses, and then they show how far a flaw like this SSRF could take an attacker. Organizations concerned about discovering and remediating critical vulnerabilities like this benefit from our continuous PTaaS services, which allow unlimited penetration tests each year and also monitor for critical vulnerabilities that may affect PTaaS customers.
Do you know which of your edge devices an attacker could reach today? Contact Raxis to find out before someone else does.
