What SonicWall disclosed
On October 6, 2026, SonicWall reported several vulnerabilities in its Secure Mobile Access 1000 product line. The advisory describes CVE-2026-102255 as a server-side request forgery, or SSRF, and assigns it a CVSS score of 10.0. It affects the WorkPlace interface. The bulletin also covers other flaws, so administrators should treat this as a broader security update rather than focusing on one CVE identifier. SonicWall said it had no evidence of in-the-wild exploitation at that time. On October 12, SecurityWeek reported attempts observed on SMA decoys as early as October 8, according to Defused, and also cited observations from Previdian. Those reports indicate attempts, not confirmed successful compromises.
Check the affected scope
The vendor lists builds 12.4.3-03526 and earlier, and 12.5.0-02952 and earlier, for the affected SMA 1000 models. It lists fixes 12.4.3-03670 and 12.5.0-03082 or later. Record each appliance’s model and build, then apply the corresponding fixed version. A general instruction to update is not a substitute for checking the exact release.
Why an SSRF matters
An SSRF occurs when a service accepts a user-supplied address and makes a request to that destination itself. Depending on controls and network context, this can expose internal services that the user could not reach directly. A maximum severity score describes an assessed risk; it does not prove a specific outcome for every deployment.
Steps for administrators
Inventory reachable SMA 1000 appliances, back up configurations under your normal procedures, install the recommended fixed firmware and verify the active version after restart. Review WorkPlace logs and unusual network flows. If you find suspicious activity, preserve evidence before resetting systems and contact SonicWall or your incident response team.
The connection with Soclyde
Administrative accounts and appliance access secrets should be limited to people who need them and stored in an appropriate system. Soclyde can help organise credentials in an encrypted vault on authorised devices. It does not fix an SSRF or directly protect SonicWall firmware.
Key points
Check each model, compare its firmware with the vendor advisory and install the matching fix. Do not infer a compromise from the vulnerability disclosure alone. To strengthen human access practices, read our guide to securing passwords.
