SonicWall SMA1000 Max-Severity Flaw Under Active Attack
A maximum-severity security flaw in SonicWall SMA1000 appliances is now being actively targeted in the wild, following the release of a vendor patch earlier this week.
Radwan AbdulhadiEditor and technology writer
Maximum-Severity Vulnerability Under Active Exploitation
Attackers are exploiting a maximum-severity vulnerability in SonicWall SMA1000 appliances (CVE-2026-102255) that was patched on Tuesday, three days ago, according to reports from cybersecurity researchers and threat intelligence analysts.
The critical security issue impacts the Appliance WorkPlace interface on the SMA1000 6210, 7210, and 8200v models. However, the vendor has clarified that the vulnerability does not affect the separate SMA 100 Series product line or SSL-VPN services running directly on standard SonicWall firewalls.
Technical Mechanics of the Attack Vectors
Describing the mechanics behind the security risk, SonicWall explained how the flaw can be leveraged by malicious actors over the network.
Previdian founder and security researcher Ryan Dewhurst noted that honeypot networks have captured suspicious traffic. According to findings shared with reporting organizations, the requests targeted the WorkPlace Extraweb interface by utilizing a crafted OPTIONS request to reach the appliance's internal CouchDB service running locally at 127.0.0.1:5984. The payload attempted to traverse into a CouchDB design document while supplying standard administrator credentials.
While this observed activity aligns closely with active targeting patterns, researchers emphasize that it remains unconfirmed whether those specific attempts successfully compromised target systems.
Exposed Infrastructure and Prior Campaign History
Internet threat visibility data provided by Shadowserver indicates that more than 400 SMA1000 appliances remain exposed online. This number includes an undetermined mix of functional corporate gateways, honeypots, and units that may or may not have received the recent security update.
Enterprise-grade secure remote access gateways in the SMA1000 lineup are frequently selected as high-value targets by malicious groups. Managed Service Providers, large enterprises, and government organizations rely heavily on these devices to facilitate secure VPN connectivity to internal corporate resources.
This latest development follows a succession of prior security incidents involving the same gateway family. Earlier in the year, threat actors abused previous gateway zero-days for weeks to deploy custom malware variants onto vulnerable infrastructure.
Broader Industry Impact and Response
Government and cybersecurity authorities have closely monitored vulnerabilities affecting these gateways. Previous campaigns exploiting similar enterprise vulnerabilities have been attributed by agencies like CISA directly to ransomware gangs.
Furthermore, vulnerability tracking updates show that attackers have previously chained multiple zero-days to achieve remote code execution on vulnerable architecture. Over the past several years, dozens of vendor-specific flaws have been cataloged among actively exploited enterprise security vulnerabilities.
Sources
- BleepingComputerMax severity SonicWall SMA1000 flaw now exploited in attacks
Continue chronologically
Related stories
Critical SonicWall SMA1000 Flaw Exploited Days After Disclosure
Threat actors are actively exploiting a critical pre-authenticated SSRF vulnerability in SonicWall SMA1000 appliances just days after its public disclosure.
CISA Confirms Active Exploitation of Maximum-Severity GitLab Flaw
CISA confirms active exploitation of a maximum-severity GitLab vulnerability tracked as CVE-2026-97229 and urges administrators to apply patches immediately.
Ivanti Patches Two More Connect Secure Zero-Days
Ivanti releases security updates for two additional Connect Secure gateway flaws chained in zero-day attacks since October, following a prior bug fix.
CISA Adds Node2Shell Flaw to KEV as Honeypots Log Attacks
CISA has added the Node2Shell Brotli vulnerability to its KEV catalog as security firms record initial exploitation attempts and major vendors issue patches.
