Attackers are attempting to exploit a maximum-severity vulnerability in SonicWall SMA1000 appliances just three days after the company released a security patch.
Tracked as CVE-2026-102255, the flaw affects the WorkPlace interface on SMA1000 6210, 7210, and 8200v models. It does not affect the SMA 100 Series or SSL-VPN running on SonicWall firewalls.
The vulnerability could allow remote attackers to send requests to internal services and perform unauthorized actions without logging in. SonicWall released a patch last week, noting that it has no evidence of the flaw being exploited in the wild.
However, a few days after the patch was released, threat actors started targeting the vulnerability. Cybersecurity company Previdian said it had detected suspicious requests matching the vulnerability. The attacks targeted an internal CouchDB service using specially crafted HTTP requests and default login credentials. Researchers have not confirmed whether the attempts successfully compromised any systems.
The flaw affects the same WorkPlace interface targeted by vulnerabilities disclosed in July and September, although the latest attack utilizes a different method.
Over the past four years, the US Cybersecurity and Infrastructure Security Agency (CISA) has added 19 SonicWall vulnerabilities to its catalog of actively exploited flaws, including 13 linked to ransomware activity.