SonicWall SMA1000 CVE-2026-102255 Exploitation Attempts — Sentinel Hunts

Threat Overview

SonicWall disclosed CVE-2026-102255 (CVSS 10.0), a pre-authentication server-side request forgery in the SMA1000 WorkPlace interface, in advisory SNWLID-2026-0017 (published October 5, updated October 6). The same update addresses CVE-2026-102256 (authenticated RCE), CVE-2026-102257 (Zip Slip), and CVE-2026-102258 (stored XSS). On October 9, Previdian reported honeypot requests consistent with exploitation of CVE-2026-102255: crafted HTTP OPTIONS requests to the WorkPlace Extraweb interface attempted to access local CouchDB at 127.0.0.1:5984 and invoke a design-document `_rewrite` function, with `admin:admin` HTTP Basic authorization. This is observed attack traffic, **not** proof of a successfully compromised appliance. SonicWall's October 6 advisory still states it had no evidence of exploitation at the time of its update. Because SMA appliances provide remote enterprise access, successful abuse could expose internal administrative functions and downstream assets.

References

Impacted Systems

Vendor/product: SonicWall Secure Mobile Access SMA1000 6210, 7210, and virtual 8200v (all hypervisors); WorkPlace/Extraweb external remote-access interface. Deployment: physical appliance or virtual appliance, typically network-exposed HTTPS remote access (specific port depends on deployment). Affected platform hotfix versions: 12.4.3-03526 and older, or 12.5.0-02952 and older. Fixed: 12.4.3-03670+ or 12.5.0-03082+. Pre-auth SSRF requires attacker network reachability to the WorkPlace interface, not credentials. SonicWall SMA 100 Series and firewall SSL-VPN are not affected by this advisory.

Why this matters

A newly reported exploitation attempt changes the risk assessment from a patch-only advisory to a targeted hunt for exposed enterprise VPN appliances.

Exploitation Status

Confirmed vulnerability and patches (SonicWall, October 6); observed exploit attempts consistent with CVE-2026-102255 (Previdian, reported October 9). Successful exploitation and victim compromise are not established in the cited reporting. Do not conflate this with earlier, separately confirmed SMA1000 exploitation in July/September.

What this hunt looks for

Layered behavioral and infrastructure searches covering: First pass — WorkPlace OPTIONS/CouchDB SSRF request indicators; Azure WAF HTTP request indicators (where WAF fronts appliance); Appliance Syslog fallback — SSRF and CouchDB markers; OPTIONS requests and request-volume anomalies at exposed gateway; Network flows involving CouchDB service port 5984; Syslog administrative or authentication changes around suspected activity.

Required logs

AzureDiagnostics, CommonSecurityLog, Syslog

Hunt 1: First pass — WorkPlace OPTIONS/CouchDB SSRF request indicators

CommonSecurityLog
| where TimeGenerated >= ago(14d)
| extend Url=tostring(column_ifexists("RequestURL","")), Method=tostring(column_ifexists("RequestMethod","")), Ext=tostring(column_ifexists("AdditionalExtensions",""))
| extend Evidence=strcat(Url," ",Ext," ",Message)
| where Evidence has_any ("_rewrite","_design","5984","127.0.0.1","Extraweb")
| where Evidence has_any ("CouchDB","_rewrite","_design","5984") or (Method =~ "OPTIONS" and Evidence has "Extraweb")
| project TimeGenerated, SourceIP, DestinationIP, DestinationHostName, DestinationPort, Method, Url, DeviceAction, Evidence
| order by TimeGenerated desc

Hunt 2: Azure WAF HTTP request indicators (where WAF fronts appliance)

AzureDiagnostics
| where TimeGenerated >= ago(14d)
| extend Uri=tostring(column_ifexists("requestUri_s","")), Method=tostring(column_ifexists("httpMethod_s","")), Client=tostring(column_ifexists("clientIP_s","")), Action=tostring(column_ifexists("action_s",""))
| where Uri has_any ("_rewrite","_design","Extraweb","5984") or (Method =~ "OPTIONS" and Uri has "WorkPlace")
| project TimeGenerated, Resource, Client, Method, Uri, Action, Category
| order by TimeGenerated desc

Hunt 3: Appliance Syslog fallback — SSRF and CouchDB markers

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ("_rewrite","_design","CouchDB","Extraweb","127.0.0.1:5984")
| project TimeGenerated, Computer, ProcessName, Facility, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Hunt 4: OPTIONS requests and request-volume anomalies at exposed gateway

CommonSecurityLog
| where TimeGenerated >= ago(7d)
| extend Url=tostring(column_ifexists("RequestURL","")), Method=tostring(column_ifexists("RequestMethod","")), Ext=tostring(column_ifexists("AdditionalExtensions",""))
| where Method =~ "OPTIONS" or Url has_any ("Extraweb","WorkPlace") or Ext has "OPTIONS"
| summarize Requests=count(), Sources=dcount(SourceIP), Methods=make_set(Method,5), Paths=make_set(Url,8) by DestinationIP, bin(TimeGenerated,1h)
| where Requests >= 20 or Sources >= 5
| order by Requests desc

Hunt 5: Network flows involving CouchDB service port 5984

CommonSecurityLog
| where TimeGenerated >= ago(14d)
| where DestinationPort == 5984
| summarize Connections=count(), Sources=make_set(SourceIP,12), Actions=make_set(DeviceAction,8) by DestinationIP, bin(TimeGenerated,1h)
| order by Connections desc

Hunt 6: Syslog administrative or authentication changes around suspected activity

Syslog
| where TimeGenerated >= ago(14d)
| where SyslogMessage has_any ("administrator","admin login","authentication failed","configuration changed","user created","privilege")
| project TimeGenerated, Computer, ProcessName, SeverityLevel, SyslogMessage
| order by TimeGenerated desc

Detection Notes

Highest signal: crafted OPTIONS requests with CouchDB design-document and `_rewrite` markers in full HTTP request logs.
Perimeter firewalls generally cannot see 127.0.0.1 loopback traffic inside an appliance; generic port 5984 flow hunts are contextual only.
Routine OPTIONS/CORS requests, vulnerability scanners, and legitimate admin activity generate noise. Confirm appliance IP and firmware externally.
TLS without reverse-proxy/WAF request logging prevents inspection of HTTP paths and methods; a no-hit result does not exclude attempts.