SonicWall SMA1000 SSRF chain enables RCE
Free public brief. The indicators, the detections with Splunk SPL already written (plus Elastic and KQL where they apply), and a Slack alert the next time this touches a vendor you run are in the app — free account, no card.
Pre-auth SSRF in SonicWall SMA1000 WorkPlace interface could chain with post-auth command injection for full remote code execution; no exploitation observed yet.
MS-ISAC/CIS published an advisory detailing four vulnerabilities in SonicWall SMA1000 Series SSL VPN appliances (models 6210, 7210, 8200v) running 12.4.3-03526 and 12.5.0-02952 or earlier. The most severe, CVE-2026-102255, is a pre-authentication server-side request forgery in the WorkPlace interface caused by an unintended alternate access path, allowing an unauthenticated remote attacker to make the appliance issue requests on their behalf and reach internal functionality.
Three lower-severity, post-authentication flaws were also disclosed: CVE-2026-102256, an OS command injection allowing an authenticated admin to execute arbitrary commands and achieve RCE; CVE-2026-102257, a Zip Slip/path traversal issue enabling writes outside intended directories; and CVE-2026-102258, a stored XSS vulnerability. The advisory notes that chaining the unauthenticated SSRF with the post-auth command injection could allow an attacker to achieve full remote code execution and system compromise without prior credentials.
No in-the-wild exploitation has been reported at time of publication. Given SMA1000 appliances are internet-facing VPN/remote-access gateways, defenders should prioritize patching per SonicWall's updates, restrict administrative interface exposure, and monitor for anomalous WorkPlace interface requests indicative of SSRF probing.
Mentioned in this report
Detection guidance
SSRF Probing Against SonicWall SMA WorkPlace Interface
Detects requests to the SMA WorkPlace interface whose query string carries internal, loopback, cloud-metadata or non-HTTP scheme targets, which is typical of SSRF probing such as the pre-auth SSRF in the SMA1000 chain. Auto-generated starting point — validate and tune in your environment before deploying. IOC matches can false-positive on shared infrastructure and decay as adversary infrastructure rotates.
title: SSRF Probing Against SonicWall SMA WorkPlace Interface
status: experimental
description: Detects web requests to the SonicWall SMA WorkPlace interface where the
query string contains loopback, link-local/cloud metadata, or non-HTTP scheme targets.
This is a generic SSRF probing pattern, relevant to the pre-authentication SSRF
in the SMA1000 chain (CVE-2026-102255). The exact vulnerable endpoint is not public
in the advisory, so this matches on the WorkPlace path plus SSRF-style targets.
Requires web or reverse-proxy logs in front of the appliance.
references:
- https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-113
tags:
- attack.initial-access
- attack.t1190
logsource:
category: webserver
detection:
selection_path:
cs-uri-stem|contains: /workplace
selection_ssrf:
cs-uri-query|contains:
- 127.0.0.1
- localhost
- 169.254.169.254
- '[::1]'
- file://
- gopher://
- dict://
- ldap://
condition: selection_path and selection_ssrf
fields:
- c-ip
- cs-uri-stem
- cs-uri-query
- sc-status
falsepositives:
- Vulnerability scanners or authorised penetration tests run against the SMA appliance
- Legitimate WorkPlace bookmarks or portal apps that reference localhost or internal
URLs in query parameters
level: medium
id: 3ba0d345-918a-52a5-b12a-07653cca46a4
author: Vorant
Behavioural rules are generated from public reporting — validate in your environment before deploying.
Source reporting: https://www.cisecurity.org/advisory/multiple-vulnerabilities-in-sonicwall-sma1000-series-appliances-could-allow-for-remote-code-execution_2026-113
What this brief leaves out
This page is the free tier: the write-up, the severity, the names. In the app the same report carries its extracted indicators, its detections (Splunk SPL already written, plus Elastic and Microsoft KQL where they apply), the actors and CVEs it names as live profiles, and the vendor research on the same campaign — the primary source the news paraphrased, cited and read directly.
It sits in a corpus of 13,854 reports from 146 sources, 616 of them written in the last seven days, and it grows through the day.
A new account starts with three days of all of it, no card, then keeps the government and CERT reporting free. Name the vendors you run and Slack hears about the reports that touch them — about forty a week that are yours, not the four hundred that are not.
Create a free account What it costs