---
title: SonicWall SMA1000 CVE-2026-102255 pre-auth SSRF under attack | ctxsec
url: https://ctxsec.com/items/sonicwall
description: ""
status: "exploitation reported, not on KEV"
published: 2026-10-09
---

> 

[← Cybersecurity News](/news) · [markdown](/items/sonicwall.md)

exploitation reported, not on KEV

2026-10-09

### SonicWall SMA1000 CVE-2026-102255 pre-auth SSRF under attack

Pre-auth SSRF in the Work Place interface (advisory SNWLID-2026-0017). Upgrade to 12.4.3-03670 or 12.5.0-03082; note 12.5.0-02952, the September zero-day fix, is now listed as affected. Canada's Cyber Centre cites open-source reports of exploitation. Not in KEV as of Oct 13.

Sources: [SonicWall PSIRT](https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017) · [CVE record](https://www.cve.org/CVERecord?id=CVE-2026-102255) · [Cyber Centre AV26-1017](https://www.cyber.gc.ca/en/alerts-advisories/sonicwall-security-advisory-av26-1017)