SonicWall rushed out a fix for a maximum-severity hole in its SMA 1000 secure remote access appliances, and attackers were already probing the flaw within days of the disclosure.
The vulnerability, tracked as CVE-2026-102255, carries a CVSS score of 10.0. It is a pre-authentication server-side request forgery bug in the appliance’s Work Place interface, born from an unintended alternate access path.
The vendor advisory is blunt: by abusing that path, an unauthenticated remote attacker could force the appliance to issue requests on their behalf, reach internal functionality, and carry out unauthorized operations. No credentials are needed.
The danger for hospitals is the appliance class itself. SMA 1000 boxes sit on the network edge and broker remote sessions for clinicians, contractors, and IT staff who need into clinical and administrative systems from off-site. A flaw that hands an anonymous attacker a foothold on that gateway is exactly the opening ransomware crews hunt for.
Researchers logged roughly 135 exploitation attempts shortly after the patch landed. SonicWall initially said it had seen no evidence of exploitation, a position that shifted as probes mounted. The one mercy: it is not full remote code execution, so an attacker must chain the SSRF into something more useful. That buys defenders little time.
Healthcare security teams should treat this as urgent. Inventory every SMA 1000 appliance exposed to the internet, patch immediately, and review logs for the alternate-path requests tied to the flaw. Any unpatched appliance is effectively an open door to the internal network. Teams should also weigh whether each appliance truly needs to face the public internet, or whether access can be narrowed to known addresses.
