{"id":"CVE-2026-102255","published":"2026-10-07T13:17:16Z","modified":"2026-10-07T16:17:32Z","title":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended…","vendor":"SonicWall","product":"SMA1000","tier":"core","eol":null,"description":{"text":"A Pre-authentication SSRF vulnerability exists in the SMA1000 Appliance Work Place interface due to an unintended alternate access path. By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations.","provenance":"source","from":"NVD"},"summary":{"text":"A pre-authentication server-side request forgery flaw in the Work Place interface of SonicWall's SMA1000 appliance stems from an unintended alternate access path that lets requests be relayed through the appliance. A remote, unauthenticated attacker with network access to the appliance, requiring no user interaction and no special configuration, can abuse this path to make the appliance issue requests on their behalf, reaching internal functionality and performing unauthorized operations.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-30T13:35:43Z"},"cvss":{"score":10.0,"severity":"CRITICAL","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H","provenance":"source","from":"NVD"},"epss":{"score":0.00981,"percentile":0.6219,"date":"2026-10-29","provenance":"source"},"kev":null,"vulncheckKev":{"dateAdded":"2026-10-07","exploitedFirstSeen":"2026-10-07","ransomware":false,"evidence":[{"url":"https://ess.coalitioninc.com/cve/?id=CVE-2026-102255&alert=2026-10-09","date":"2026-10-07"},{"url":"https://previdian.com/CVE-2026-102255","date":"2026-10-09"},{"url":"https://x.com/DefusedCyber/status/2108543042693058984","date":"2026-10-09"},{"url":"https://x.com/PrevidianCyber/status/2108481433010340097","date":"2026-10-10"}],"evidenceTotal":4,"provenance":"source"},"exploited":true,"otx":{"pulseCount":11,"pulses":[{"name":"AhsayCBS Backup Console Under Active Exploitation: CVE-2026-105133/105134 Chain Leads From Auth Bypass to RCE, and 10.3.4.0 Does Not Close It .","url":"https://otx.alienvault.com/pulse/6ad75b2fdad28fe85e48ec5b","created":"2026-10-20"},{"name":"Known_Cve | Oct 16, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ad0e933fc9a5a47b66d7921","created":"2026-10-15"},{"name":"Known_Cve | Oct 15, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6acf98726e4260f2f2ba3d49","created":"2026-10-14"},{"name":"Known_Cve | Oct 14, 2026 | Part 1/3","url":"https://otx.alienvault.com/pulse/6ace466c18a71dd7afa3f788","created":"2026-10-13"},{"name":"Known_Cve | Oct 13, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6accf723f346ce4b8a50d55a","created":"2026-10-12"},{"name":"Known_Cve | Oct 12, 2026 | Part 1/2","url":"https://otx.alienvault.com/pulse/6acba8a68a86c4d9508005a7","created":"2026-10-11"},{"name":"[ShadowBrieferFeed] Max severity SonicWall SMA1000 flaw now exploited in attacks","url":"https://otx.alienvault.com/pulse/6aca8431e3ee0a8c14156255","created":"2026-10-10"},{"name":"Known_Cve | Oct 11, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6aca554c34feb0ce115b09d6","created":"2026-10-10"},{"name":"Known_Cve | Oct 10, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac90361476f45b4b982597d","created":"2026-10-09"},{"name":"Known_Cve | Oct 9, 2026 | Part 2/2","url":"https://otx.alienvault.com/pulse/6ac7b1a3f215e7af4290dc2e","created":"2026-10-08"}],"provenance":"machine"},"cwes":[{"id":"CWE-441","name":"Unintended Proxy or Intermediary"},{"id":"CWE-918","name":"Server-Side Request Forgery"}],"references":[{"url":"https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017","tags":[]}],"techniques":[],"reports":[],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2026-94324","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2026-94324","exploited":false,"exploitedSince":null,"provenance":"source"},"exploits":[],"exploitSources":{"pocGithub":{"count":3,"skipped":0,"earliest":"2026-10-12","earliestUrl":"https://github.com/HORKimhab/CVE-2026-102255","repos":[{"name":"HORKimhab/CVE-2026-102255","url":"https://github.com/HORKimhab/CVE-2026-102255","stars":0,"created":"2026-10-12"},{"name":"techupdate24/sonicwall-sma-1000-cve-2026-102255","url":"https://github.com/techupdate24/sonicwall-sma-1000-cve-2026-102255","stars":0,"created":"2026-10-12"},{"name":"CompleteTech-Security/sonicwall-sma1000-cve-2026-102255-check","url":"https://github.com/CompleteTech-Security/sonicwall-sma1000-cve-2026-102255-check","stars":0,"created":"2026-10-23"}]},"first":{"date":"2026-10-12","source":"PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-102255"},"provenance":"source"},"exploitRefs":[],"flow":[],"timeline":[{"date":"2026-10-07","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2026-102255","provenance":"source"},{"date":"2026-10-07","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://ess.coalitioninc.com/cve/?id=CVE-2026-102255&alert=2026-10-09","provenance":"source"},{"date":"2026-10-12","kind":"exploit-public","label":"First public exploit: PoC-in-GitHub","url":"https://github.com/HORKimhab/CVE-2026-102255","provenance":"source"}],"speed":{"daysToPublicExploit":5,"firstExploitFrom":"PoC-in-GitHub","daysToKev":null},"priority":{"score":71.9,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in VulnCheck KEV"},{"name":"Recent KEV listing","points":10.0,"detail":"added 23 days ago"},{"name":"Known ransomware use","points":0.0,"detail":"not known"},{"name":"EPSS percentile","points":12.44,"detail":"percentile 0.6219"},{"name":"Named in threat reports","points":0.0,"detail":"0 reports"},{"name":"Public exploit code","points":5.0,"detail":"3 PoC-in-GitHub repos"},{"name":"Mentioned in OTX pulses","points":2.45,"detail":"11 pulses"},{"name":"CVSS severity","points":7.0,"detail":"base score 10.0"},{"name":"End-of-life product","points":0.0,"detail":"supported or unknown"}]}}