FlawOpen

flawopen.com/Teardowns/cve-2026-102255-sonicwall-sma1000-workplace-ssrf

● CVE-2026-102255 · CVSS 10.0[1] · Critical
FlawOpen Security Research

CVE-2026-102255: SonicWall SMA1000 WorkPlace SSRF

CVE-2026-102255 is a CVSS 10.0 pre-authentication SSRF in SonicWall SMA1000 WorkPlace. On October 12, MS-ISAC said there were currently no reports of the four bulletin vulnerabilities being exploited in the wild. It also described a conditional path from this SSRF to remote code execution if chained with CVE-2026-102256, a separate command-injection flaw requiring an authenticated administrator. The advisory provides no chain mechanics or account-transition detail; it is a risk assessment, not a demonstrated chain. October 9 honeypot attempts consistent with CVE-2026-102255 were reported, but successful compromise was not established. Upgrade to the fixed platform hotfix.[1], [2], [3], [4], [5], [6]

💡 Plain English Explainer (ELI5)

Imagine the appliance as a receptionist who carries messages between rooms. This flaw lets a stranger ask the receptionist to deliver a message into rooms that should require an identity check. SonicWall fixed the path; its notice does not reveal the internal route or source patch.[1]

Core Concepts & Subsystem Terms

Server-side request forgery (SSRF)
A server is tricked into making a request chosen by an untrusted caller. SonicWall says the appliance can issue requests on the caller’s behalf and reach internal functionality.[1], [3]

Framework mappings

  • CWE reference for the weakness described in this guide: CWE-918

Root Cause Analysis

SonicWall describes an unintended alternate access path in the SMA1000 Appliance WorkPlace interface. An unauthenticated remote attacker may cause the appliance to issue requests on the attacker’s behalf, reach internal functionality, and perform unauthorized operations. SonicWall's notice does not publish a firmware source diff. BleepingComputer quotes researcher Ryan Dewhurst reporting honeypot attempts that used OPTIONS against WorkPlace Extraweb and targeted the local CouchDB service. The report does not establish that any attempt compromised a system; this article treats it as an attributed attempt report, not confirmed exploitation. The reported payload and credentials are not reproduced. SonicWall rates the issue CVSS 10.0 Critical; the CVE record lists CWE-918. The vendor says these October vulnerabilities are unrelated to other reported SonicWall vulnerabilities. Do not combine this CVE with earlier SMA1000 disclosures into an exploit chain. SonicWall’s October 6 notice said there was no evidence of in-the-wild exploitation at that time. On October 9, BleepingComputer reported that researcher Ryan Dewhurst said Previdian honeypots detected attempts consistent with this CVE; Dewhurst said successful compromise had not been established. Update, October 12, 2026: MS-ISAC says there are currently no reports of the four vulnerabilities in this bulletin being exploited in the wild. This is consistent with the October 9 report of honeypot attempts: attempts do not establish successful exploitation, and MS-ISAC names no victim. The same advisory assesses that the pre-authentication SSRF, CVE-2026-102255, could be chained with CVE-2026-102256, a separate OS command-injection flaw that requires an authenticated administrator, to result in remote code execution and full system compromise. It does not explain how the authentication prerequisite would be met, identify a demonstrated sequence, or report this chain in observed activity. Treat this as a conditional government risk assessment, not a confirmed or reproducible exploit chain. SonicWall lists fixed builds 12.4.3-03670+ and 12.5.0-03082+ for the bulletin; patch the affected appliance regardless of whether the chain is established.[1], [2], [3], [4], [6]

Step-by-Step Attack Flow

Step 1

Unauthenticated request reaches WorkPlace

SonicWall locates the pre-authentication flaw in SMA1000 WorkPlace. BleepingComputer reports honeypot OPTIONS attempts against WorkPlace Extraweb; this does not establish a successful compromise.[1], [4]

Step 2

The appliance acts on the caller’s behalf

The vendor says the appliance may reach internal functionality and perform unauthorized operations. BleepingComputer reports that attempts targeted local CouchDB, but the researcher had not established successful compromise.[1], [4]

Step 3

Operator response: patch and investigate

SonicWall identifies fixed builds 12.4.3-03670+ and 12.5.0-03082+. If patching is delayed, restrict WorkPlace exposure as interim containment, preserve logs, and investigate. The reported attempts do not establish successful compromise.[1], [4], [5]

Source Code: Flaw vs. Secure Implementation

Firmware source and the vendor patch diff are not public. This generic Python example limits callers to a fixed service identifier; the application controls the origin and path and disables redirects. It is not SonicWall code, does not reproduce CVE-2026-102255, and is not a complete SSRF defense. Apply SonicWall’s platform hotfix.[1]

Source excerpt: Generic SSRF defense illustration; not SonicWall source

UNPATCHED FLAW
# Generic illustration only; not SonicWall source or a reproduction.
def fetch_health(user_supplied_url, session):
    return session.get(user_supplied_url, timeout=3)
HARDENED SECURE PATCH
# Generic SSRF defense pattern only; not SonicWall source or a complete patch.
from urllib.parse import urljoin

SERVICE_PATHS = {"status": "/health"}
BASE_URLS = {"status": "https://status.example.internal"}

def fetch_health(service_id, session):
    base = BASE_URLS.get(service_id)
    path = SERVICE_PATHS.get(service_id)
    if base is None or path is None:
        raise ValueError("unknown service")
    # User input selects a fixed capability, never a URL or host.
    return session.get(urljoin(base, path), timeout=(2, 3), allow_redirects=False)

Engineering & System Hardening Checklist

Sources