Max severity SonicWall SMA1000 flaw now exploited in attacks

Attackers are actively exploiting a maximum-severity vulnerability (CVE-2026-102255) in SonicWall SMA1000 appliances, specifically targeting the Appliance WorkPlace interface on SMA1000 6210, 7210, and 8200v models. The flaw allows unauthenticated remote attackers to abuse a path to direct the appliance to issue internal requests, potentially reaching internal functionality such as the CouchDB service via a Server-Side Request Forgery (SSRF) technique. Exploitation attempts have been observed using crafted OPTIONS requests to access the internal CouchDB service at 127.0.0.1:5984, with an HTTP Basic Authorization header containing default credentials admin:admin.

AI-extracted · verify before operational use