SonicWall patches CVSS 10.0 SSRF in SMA1000 as exploits hit decoys two days later

SonicWall published advisory SNWLID-2026-0017 on 6 October 2026 covering four flaws in SMA1000, led by pre-authentication SSRF CVE-2026-102255 in the Work Place interface rated CVSS 10.0. Defused reported the first exploitation attempts against its decoys on 8 October, two days after disclosure, while the vendor says there is no evidence of in-the-wild exploitation.

• CVE-2026-102255: pre-auth SSRF in Work Place, CVSS 10.0, CWE-441 confused deputy
• Affected: models 6210, 7210, 8200v on 12.4.3-03526 and 12.5.0-02952 or older
• Fixed hotfixes: 12.4.3-03670 and 12.5.0-03082 and higher
• First exploitation attempts hit Defused decoys on 8 October 2026