SonicWall SMA1000 Max-Severity Flaw Under Active Attack Days After Patch

Attackers are actively targeting a maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 secure remote access gateways just three days after a patch was released. Security researcher Ryan Dewhurst of Previdian reported honeypot captures showing crafted OPTIONS requests aimed at the appliance's WorkPlace Extraweb interface. The exploitation technique attempts to reach an internal CouchDB service on 127.0.0.1 and traverse into a design document using basic "admin:admin" credentials. Shadowserver telemetry currently shows over 400 SMA1000 appliances exposed to the public internet, though it remains unclear how many are patched or functioning as honeypots. The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its actively exploited catalog over the last four years, with 13 linked directly to ransomware gangs. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." — SonicWall