SonicWall's advisory SNWLID-2026-0017 (Oct 6) covered CVE-2026-102255, an unauthenticated SSRF in SMA1000 WorkPlace rated CVSS 10.0. The advisory didn't say whether it was exploited. On Oct 9, researchers at Previdian said their honeypots had caught exploitation, with attempts aimed at the appliance's internal CouchDB service on localhost (per SC Media).
Suzu Labs CTO Denis Calderone told SC Media this is the third CVSS 10.0 pre-auth SSRF in WorkPlace in nine months (July, September, October). A public Metasploit module from the September chain already shows how to turn CouchDB access into root on these appliances, and the internal architecture hasn't changed. There's no workaround, and SonicWall hasn't published indicators of compromise. As of Friday it wasn't on CISA's KEV list.
What we'd do tonight: move SMA 6210, 7210 and 8200v to the fixed builds in SNWLID-2026-0017, and if you can't, pull WorkPlace off the internet until you can. Then hunt anyway. Look for outbound requests from the appliance to localhost or internal ports, new admin accounts, and unexpected CouchDB writes since Oct 6. Because the July advisory's log patterns came from a related chain, they're a reasonable starting point.