SonicWall SMA 1000 CVE-2026-102255 (CVSS 10.0) pre-auth SSRF in the WorkPlace portal, SNWLID-2026-0017, exploitation attempts seen: which firmware fixes it?

What it is: SonicWall advisory SNWLID-2026-0017 (October 6, 2026) fixes four SMA 1000 vulnerabilities, the worst being CVE-2026-102255, a pre-authentication server-side request forgery in the internet-facing WorkPlace interface. An unauthenticated attacker can make the appliance send requests to internal endpoints that trust it, reaching functions meant for logged-in users or admins. Honeypots recorded exploitation attempts within about a day of disclosure, and attempts are still being reported in late October. It is the third pre-auth SSRF in this interface in 2026, and the earlier two were exploited in the wild. SonicWall lists no workaround. Am I affected: - SMA 1000 series appliances, physical or virtual (6210, 7210, 8200v and others in the series), on firmware before 12.4.3-03670 or before 12.5.0-03082. Check the firmware version in the appliance management console (AMC). SMA 100 series and SonicWall firewalls are separate products. - A firmware level that was patched for the earlier 2026 SSRF bugs is not enough; it must be at or above the versions below. Fix: upgrade to 12.4.3-03670 or later on the 12.4 line, or 12.5.0-03082 or later on the 12.5 line, using the hotfix from MySonicWall. Interim mitigation until you can patch: limit access to the WorkPlace portal and management interface to known IP ranges where your deployment allows it, put the AMC on an internal management network only, and watch appliance logs closely; plan the upgrade as an emergency change. After: review appliance and AMC logs since October 6 for unusual unauthenticated requests, new or changed admin accounts, configuration changes and unexpected sessions. If you find signs of compromise, rotate credentials stored on or authenticated through the appliance (admin, LDAP/AD bind accounts, certificates) and review the internal systems it can reach. Sources: https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways/ https://www.helpnetsecurity.com/2026/10/07/sonicwall-fixes-pre-auth-ssrf-flaw-in-sma-1000-appliances-cve-2026-102255/ https://digital.nhs.uk/cyber-alerts/2026/cc-4863