Researcher detects attack attempts against patched SonicWall SMA1000 flaw

Previdian has detected exploitation attempts consistent with CVE-2026-102255, a maximum-severity SonicWall SMA1000 vulnerability patched three days earlier, founder Ryan Dewhurst told BleepingComputer. The flaw affects the Appliance WorkPlace interface on 6210, 7210 and 8200v models, allowing unauthenticated attackers potentially to make the appliance reach internal functions and perform unauthorized operations. The observed requests targeted an internal CouchDB service through the WorkPlace Extraweb interface. Shadowserver tracks more than 400 SMA1000 appliances exposed online, though their patch status and the number of honeypots are unknown. Previdian has not established whether the attempts successfully compromised any systems; SonicWall's Tuesday advisory had not flagged active exploitation.