SonicWall fixes maximum-severity SSRF flaw under active attack

Oct 13, 20261 min readEdition: 2026-10-13-cybersecurity-advisories

Topographic elevation contour card for SonicWall fixes maximum-severity SSRF flaw under active attack — VISUAL ARTWORK:Original editorial artwork. Third-party brand marks used under nominative fair use.

What happened.SonicWall released emergency platform hotfixes for its Secure Mobile Access 1000 Series appliances. The update repairs a critical server-side request forgery vulnerability that threat actors are actively exploiting in the wild.

Why it matters.Intruders are using unpatched remote access appliances to tunnel directly into protected corporate networks. Teams operating SMA 1000 gateways should patch today and audit internal servers for rogue traffic from gateway IP addresses.

The technical specifications:

Mechanism: The Appliance WorkPlace interface functions as an unintended forward proxy, letting remote attackers query internal services and databases like CouchDB.
Scope: The defect affects SMA 6210, 7210, and 8200v gateways running firmware 12.4.3 and 12.5.0, leaving SMA 100 series appliances untouched.
Action: Organizations must download hotfix 12.4.3-03670 or 12.5.0-03082 through the MySonicWall portal and inspect internal database logs for unauthorized requests.

TOPICS:

#security #exploit-in-the-wild #critical-infrastructure