SonicWall published advisory SNWLID-2026-0017 on 6 October 2026 covering four flaws in Secure Mobile Access (SMA) 1000 series appliances, physical and virtual SMA 6210, 7210 and 8200v. The worst, CVE-2026-102255 (CVSS 10.0), sits in the Appliance WorkPlace interface: an unintended alternate access path lets the appliance act as a forward proxy, so a remote attacker with no login can make it send requests on their behalf, reach internal functions and perform unauthorised operations (CWE-918 server-side request forgery and CWE-441 unintended proxy).

The other three need an administrator account: CVE-2026-102256 (7.8) is an operating-system command injection that can give remote code execution, CVE-2026-102257 (7.2) is a Zip Slip path traversal in the Appliance Management Console (AMC) that can also lead to code execution, and CVE-2026-102258 (5.5) is stored cross-site scripting in AMC.

SonicWall says it has no evidence any of the four are being exploited, lists no workaround, and says SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected.

Benoît Sevens of Anthropic reported the SSRF and command-injection bugs; Brian Mariani reported the Zip Slip through Trend Micro's Zero Day Initiative and the XSS through DigitalCanion SA. Important for anyone who patched last month: the builds that fixed the exploited September zero-days CVE-2026-83548 and CVE-2026-83549 (12.4.3-03526 and 12.5.0-02952) are the last affected builds in this advisory. Shadowserver tracks more than 400 internet-exposed SMA1000 appliances, and CISA has added 19 SonicWall flaws to its exploited list in four years, so expect attention.

Primary: SonicWall PSIRT advisory; wires: BleepingComputer and Cyber Security News (7 Oct).

UPDATE (9 Oct): BleepingComputer reported on 9 October that Previdian's honeypot network has seen exploitation attempts consistent with CVE-2026-102255: crafted OPTIONS requests to the WorkPlace Extraweb interface tried to reach the appliance's internal CouchDB service on 127.0.0.1:5984 and call a design document's _rewrite function using admin:admin credentials, a different technique from the July and September SMA1000 SSRF attacks.

Previdian has not established whether any attempt succeeded, and SonicWall's advisory had not marked the flaw as exploited. Shadowserver tracks more than 400 SMA1000 appliances exposed online.

UPDATE (13 Oct): The Hacker News reported on 12 October that the first exploitation attempts were seen by two threat intelligence firms, Defused Cyber and Previdian, on 8 October, two days after the fix shipped. Previdian has counted 135 attempts so far from two IP addresses located in the United States; those are sensor hits, not confirmed compromises, and the IP locations say nothing about where the attackers are.

SonicWall had still not updated its advisory to mark the flaw as exploited.

Earlier SMA1000 zero-days were used to steal credentials, session databases and TOTP multi-factor seeds before moving into internal networks, so treat an unpatched appliance as a possible foothold.