Three Days From "No Evidence" to Exploited: The SonicWall Patch-Gap Window and the SMA1000 Problem

Introduction

On Tuesday morning, SonicWall told customers something vendors say thousands of times a day: patch your appliances, and by the way, "there is currently no evidence any of the vulnerabilities addressed in this release are being exploited in the wild." The advisories that came with the hotfixes described CVE-2026-102255, a maximum-severity server-side request forgery in the Appliance WorkPlace interface of the SMA1000 series — the secure remote access gateways that government agencies, managed service providers, and large corporations use to reach internal apps and corporate networks.

By Friday, that sentence was already wrong.

Ryan Dewhurst, founder of security firm Previdian, told BleepingComputer that the company's honeypot network had detected exploitation attempts consistent with the flaw within three days of the patch. The requests targeted the WorkPlace Extraweb interface with a crafted OPTIONS request aimed at the appliance's internal CouchDB service at 127.0.0.1:5984. The payload tried to traverse into a CouchDB design document and invoke its _rewrite function, while supplying an HTTP Basic Authorization header containing the credentials admin:admin. Whether any of those attempts actually compromised a system is not yet known. The window, though, is the story: 72 hours from "no evidence" to first observed probes.

That is the uncomfortable arithmetic of internet-facing security appliances in 2026, and it is worth reading alongside a second incident from the same week — the AhsayCBS backup platform, where attackers are running webshells and cryptocurrency miners through flaws that have no patch at all. One vulnerability gave defenders a window measured in days. The other gave them no window.

What CVE-2026-102255 actually is

The flaw sits in the Appliance WorkPlace interface on three SMA1000 models: the 6210 and 7210 hardware appliances and the 8200v virtual edition. It does not affect the SMA 100 Series product line, nor SSL-VPN running on SonicWall firewalls. SonicWall describes it as an "unintended alternate access-path weakness" that a remote, unauthenticated attacker can exploit in low-complexity attacks.

The impact line is the part administrators should read twice. "By abusing this path, a remote unauthenticated attacker could potentially exploit this vulnerability to direct the appliance to issue requests on their behalf and reach internal functionality and perform unauthorized operations," the vendor explained. In other words, the appliance itself becomes the proxy. The attacker does not need to be on the internal network; they make the appliance do the reaching for them, and anything the appliance can touch — internal management consoles, databases, services bound to loopback — becomes reachable from the outside.

That is the textbook definition of SSRF, and the honeypot traffic Previdian captured shows exactly how it is being probed in practice. The OPTIONS request is a reconnaissance move: it asks the server which methods it supports without submitting a body, a cheap way to map the interface before the real payload. The target is the internal CouchDB instance at 127.0.0.1:5984 — the kind of administrative service that is never meant to be exposed but is often reachable from the appliance's own processes. The attempt to invoke CouchDB's _rewrite function through a design document is a known SSRF gadget, and the admin:admin header in the request suggests the attackers are testing whether default or factory credentials survive inside the appliance's internal trust boundary.

A repeat offender

The SMA1000 line has been a target all year, and the WorkPlace interface in particular. In July, two SMA1000 zero-days tracked as CVE-2026-15409 and CVE-2026-15410 were exploited for weeks to install custom malware families the researchers named Sou5, OrangeTail, and RootRun. The U.S. Cybersecurity and Infrastructure Security Agency later linked some of those attacks to ransomware gangs. In September, SonicWall warned that attackers were chaining two more zero-days, CVE-2026-83548 and CVE-2026-83549, to execute remote code on the same gateways.

Dewhurst noted that the October flaw hits the same WorkPlace interface targeted by the July and September disclosures, but uses a different exploitation technique. That matters for defenders who patched the earlier flaws and assumed they were safe: the interface keeps generating new paths, and each one has to be fixed on its own.

The broader record is sobering. Over the last four years, CISA has added 19 SonicWall vulnerabilities to its Known Exploited Vulnerabilities catalog, and flagged 13 of them as used in ransomware attacks. Shadowserver currently tracks more than 400 SMA1000 appliances reachable from the public internet, though it has no way to distinguish patched systems from honeypots.

The other half of the week: AhsayCBS, with no patch at all

The same week SonicWall was closing its 72-hour window, a second internet-facing platform was being actively exploited with no fix in sight. Huntress, a managed detection and response company, observed attackers exploiting two vulnerabilities in AhsayCBS, a backup management platform typically used by managed service providers and system integrators. The malicious activity was first seen on October 7 and targeted at least five organizations.

The two flaws are tracked as CVE-2026-105133, an authentication bypass with a public exploit, and CVE-2026-105134, an OS command injection. Both are reported as fixed in AhsayCBS 10.3.2 — but Huntress found that they also affect Ahsay 10.3.4, currently the latest version. That is the detail that turns a routine advisory into an emergency: the "fixed" label is misleading, and the version administrators are running is still vulnerable.

In the observed attacks, the threat actor chained the two flaws, using CVE-2026-105133 first to bypass authentication and then CVE-2026-105134 for code execution. After gaining access, the attacker performed reconnaissance, deployed Java Server Page webshells, and downloaded the XMRig cryptocurrency miner disguised as edge.exe. The miner persists through a service named MicrosoftEdgeUpdateSvc, which runs msedge.exe — a modified copy of the legitimate Non-Sucking Service Manager utility. A PowerShell file, Taskgmr.ps1, that Huntress believes to be AI-assisted, conceals the mining activity by stopping the service when Task Manager opens and restarting it when Task Manager closes. In one case the attacker also deployed the vulnerable WinRing0x64.sys driver, likely to unlock more hardware resources for the miner.

Until a patch is available, Huntress recommends restricting access to the AhsayCBS management interface to trusted IP addresses only, and investigating any signs of compromise. If a compromise is confirmed, administrators should perform a full restore from a safe backup, because the attacker may have installed additional backdoors for prolonged persistence.

The arithmetic defenders should take from the week

These two incidents are not the same story, but they are the same lesson. The SonicWall flaw was maximum-severity, unauthenticated, and low-complexity — and it still took only 72 hours from patch to first observed exploitation. The AhsayCBS flaws are lower-severity individually, but they chain into full code execution, the "fixed" version is not actually fixed, and there is no patch on the way. In both cases the attack surface is the management interface of an appliance that organizations have bolted to the internet because that is what remote access requires.

The guidance is not new, but it is worth restating in the order that matters. Turn off unused services and ports, especially remote access and file sharing. Require multifactor authentication for webmail, VPNs, and any account that can reach critical systems. Watch for unexpected Active Directory replication, which is the signature of DCSync-style credential theft. Review cloud accounts for connected applications that can read files and email. And apply patches on the day they ship, because for appliances like the SMA1000 the gap between "no evidence" and "actively exploited" is no longer measured in weeks.

The vendors' disclosures are improving — SonicWall shipped hotfixes the same day it disclosed, and its advisory language was precise about what the flaw lets an attacker do. But the disclosure is only half the job. The other half is the 400-plus appliances still reachable from the internet, the backup platforms with "fixed" labels that do not fix the latest version, and the attackers who now treat patch Tuesday as a shopping list.

References

• BleepingComputer, "Max severity SonicWall SMA1000 flaw now exploited in attacks," October 9, 2026 — https://www.bleepingcomputer.com/news/security/max-severity-sonicwall-sma1000-flaw-now-exploited-in-attacks/
• BleepingComputer, "SonicWall warns of max severity SSRF flaw in SMA1000 gateways," October 7, 2026 — https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways/
• BleepingComputer, "Unpatched AhsayCBS flaws exploited to deploy webshells, mine crypto," October 9, 2026 — https://www.bleepingcomputer.com/news/security/unpatched-ahsaycbs-flaws-exploited-to-deploy-webshells-mine-crypto/
• SonicWall SMA1000 security advisory for CVE-2026-102255 — https://www.sonicwall.com/support/knowledge-base/
• CISA Known Exploited Vulnerabilities Catalog — https://www.cisa.gov/known-exploited-vulnerabilities-catalog
• Shadowserver Foundation, internet-exposed SMA1000 tracking — https://shadowserver.org/

For more on how security teams are handling patch-gap exploitation, see our cybersecurity coverage.