SonicWall Patched the Same Front Door Three Times in 12 Weeks. September's Fix Is Now on the Affected List.

Opening & At a Glance

Picture the admin who did everything right in September. SonicWall flagged two SMA1000 zero-days under active attack. They pulled the hotfix, scheduled the outage, rebooted the VPN gateway at 11pm, and closed the ticket. Done.

On 6 October 2026 that exact build, 12.5.0-02952, showed up on a new advisory under "affected." Two days later, attack traffic hit decoy appliances. Same portal. Different trick.

What Happened, in Plain English

SMA1000 boxes are remote-access gateways. Staff hit the Work Place portal from outside, log in, and reach internal apps. That makes the portal the one piece of the appliance that has to face the internet.

SonicWall says the new flaw is an "unintended alternate access path" that lets an unauthenticated attacker "direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations." In other words, the gateway can be talked into acting as the attacker's proxy toward things that were only meant to listen to the gateway itself.

Previdian founder Ryan Dewhurst told BleepingComputer the captured requests used a crafted OPTIONS request to reach the appliance's internal CouchDB service on 127.0.0.1:5984, tried to invoke a design document's _rewrite function, and sent the credentials admin:admin. Beazley Security published the payload and a source IP, 146.70.143[.]142, as an indicator. Horizon3.ai said it was investigating and warned the bug could lead to device takeover. SonicWall itself has said nothing that specific.

The same bulletin also fixes three post-authentication bugs: an OS command injection (CVE-2026-102256), a Zip Slip path traversal in the management console (CVE-2026-102257), and a stored XSS (CVE-2026-102258).

Confirmed vs Analysis — Keep the Labels Honest

Why It Matters: One Portal, Three Rounds

Here's the pattern that bothers me more than the score. In July, attackers used two SMA1000 zero-days (CVE-2026-15409 and CVE-2026-15410) for weeks; BleepingComputer reports custom malware on the appliances and CISA later tied some of the activity to ransomware gangs. On 1 September, SonicWall disclosed another chained pair (CVE-2026-83548 and CVE-2026-83549), also exploited before a fix. Now October. Dewhurst says all three target the same Work Place interface.

Three rounds in twelve weeks tells you the interface has a class of problem, not a single bug. Patching each instance is necessary. It isn't a strategy. If your remote-access story depends on one vendor portal being exposed to the whole internet, you are betting that the next variant gets found by a researcher before it gets found by a crew with a scanner.

Shadowserver counts a little over 400 SMA1000 appliances visible online. That's small. It's also the kind of number that makes targeting easy, and BleepingComputer notes these gateways are popular with managed service providers, large companies and government agencies. A small fleet with valuable owners is exactly what a patient attacker wants. We saw the same edge-device rhythm with Citrix NetScaler's zero-days two weeks ago.

And don't wait for KEV. CISA listed the July and September pairs within a day, but both of those advisories carried SonicWall's own exploitation statement. This one doesn't yet. A missing KEV entry is a paperwork gap, not a safety signal.

What to Do This Week

• Check the build, not the ticket. If a September change record says "patched," confirm the box is on 12.5.0-03082 or 12.4.3-03670 now.
• Shrink the front door. Where the business allows, limit Work Place to known source ranges, and make sure the management console isn't reachable from the internet (both suggested by Beazley Security as stopgaps).
• Hunt, then patch again if needed. Look for the published indicator IP, unexpected admin activity, config changes and odd outbound connections since 6 October.
• Ask the bigger question. After three rounds, it's fair to put a timeline on reducing what this portal exposes, whatever product sits there.

Closing & Sources

What we can say carefully: CVE-2026-102255 is a CVSS 10 pre-auth SSRF in SMA1000 Work Place, fixed on 6 October, and the build that fixed September's zero-days is vulnerable again. Honeypots saw attempts within two days. Nobody has publicly confirmed a successful compromise, SonicWall hasn't updated its exploitation status, and CISA hasn't listed it. Patch anyway. The history of this portal earns that.

• CVE.org — CVE-2026-102255 record (updated 7 Oct 2026), referencing SonicWall SNWLID-2026-0017
• Beazley Security Labs — BSL-A1223 advisory (6 Oct 2026, updated 9 Oct)
• BleepingComputer (Sergiu Gatlan) — "Max severity SonicWall SMA1000 flaw now exploited in attacks" (9 Oct 2026)
• SecurityWeek (Ionut Arghire) — "Critical SonicWall Vulnerability Exploited Days After Disclosure" (12 Oct 2026)
• Canadian Centre for Cyber Security — AV26-1017, Update 1 (9 Oct 2026)

Methodology Note: Editorial synthesis of the CVE record and vendor advisory details (as reproduced by Beazley Security, since SonicWall's PSIRT page did not load for us), with BleepingComputer, SecurityWeek and the Canadian Cyber Centre for exploitation reporting. Exploitation-attempt claims come from honeypot operators and are not confirmed compromises. KEV status checked as of 12 Oct 2026. RogueGhost is not affiliated with SonicWall or any firm named. Analysis labelled as analysis.