Cybersecurity
SonicWall flaw exploited days after patch
Researchers said attempts matched CVE-2026-102255 against SonicWall SMA1000 appliances, while SonicWall’s advisory had not yet called it active exploitation and the company said the flaw could let attackers issue requests and reach internal functions.
- SonicWall said it patched CVE-2026-102255 on Tuesday and had not yet labelled it as actively exploited in its advisory.
- The flaw affected the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models, and did not affect the SMA 100 Series or SSL-VPN on SonicWall firewalls.
- Ryan Dewhurst said Previdian’s honeypot network had seen attempts consistent with the flaw.
- Shadowserver tracked more than 400 SMA1000 appliances exposed online, and CISA had previously added 19 SonicWall vulnerabilities to its actively exploited catalogue.
SonicWall said CVE-2026-102255 affected the Appliance WorkPlace interface on SMA1000 6210, 7210 and 8200v models. It said a remote unauthenticated attacker could make the appliance issue requests and reach internal functions, and that the issue did not affect the SMA 100 Series or SSL-VPN on SonicWall firewalls.
Ryan Dewhurst, founder of Previdian, told BleepingComputer that his honeypot network had seen requests that matched the flaw. He said they targeted the WorkPlace Extraweb interface, used an OPTIONS request, tried to reach an internal CouchDB service at 127.0.0.1:5984, and carried a Basic Authorization header with admin:admin.
Dewhurst said the activity was consistent with exploitation attempts, but Previdian had not established whether any systems had been compromised. SonicWall had not yet marked the issue as actively exploited in its Tuesday advisory.
Shadowserver said it tracked more than 400 SMA1000 appliances exposed online, although it was unclear how many were honeypots or already patched. The article also said SonicWall gateways had been targeted before, including July attacks that used CVE-2026-15409 and CVE-2026-15410 to install Sou5, OrangeTail and RootRun malware.
CISA later linked some of those July attacks to ransomware gangs. SonicWall also warned last month that attackers were chaining CVE-2026-83548 and CVE-2026-83549 to execute code on vulnerable SMA1000 gateways, and the article said CISA had added 19 SonicWall vulnerabilities to its catalogue of actively exploited flaws, 13 of them linked to ransomware gangs.
Named in this story
People
- Ryan Dewhurst
- said Previdian had detected attempts matching the flaw
Companies
- SonicWall
- said the flaw could let a remote attacker issue requests and issued the Tuesday advisory
- Previdian
- ran the honeypot network that saw the attempts
Organisations
- Shadowserver
- tracked more than 400 SMA1000 appliances exposed online
Governments and agencies
- CISA
- later linked some SonicWall attacks to ransomware gangs and catalogued exploited flaws
Products and systems
- CVE-2026-102255
- identified the flaw being discussed
- SMA1000 appliances
- were the appliances affected by the flaw
- Appliance WorkPlace interface
- was the interface affected on the SMA1000
- SMA1000 6210, 7210, and 8200v models
- were the specific models named as affected
- Sou5, OrangeTail, and RootRun malware
- were installed on vulnerable appliances in July attacks
How the source tells it
The register was mostly plain news, but it leaned on urgency through the severity label and the repeated emphasis on active exploitation.
- urgency the opening focus on exploitation and the very recent patch timing
- alarm the maximum-severity label and repeated references to attacks already under way