SonicWall SMA1000 flaw rated CVSS 10.0 draws exploitation attempts

A honeypot operator reports attempts to exploit CVE-2026-102255, a pre-authentication flaw in SonicWall SMA1000 gateways, though SonicWall still reports no exploitation. A gvproxy flaw lets code inside a Podman VM delete host files, and CERT.at and BSI warn of a new NetScaler flaw.

Vulnerabilities

CVE-2026-102255 - SonicWall SMA1000, CVSS 3.1 10.0

What it allows. A server-side request forgery in the WorkPlace interface lets an unauthenticated attacker make the appliance issue requests on their behalf, reach internal functions and perform unauthorised operations, according to SonicWall’s advisory. On 9 October Previdian founder Ryan Dewhurst told BleepingComputer that the company’s honeypots had detected exploitation attempts consistent with the flaw: crafted OPTIONS requests aimed at the appliance’s internal CouchDB service on 127.0.0.1:5984. Previdian has not established whether those attempts would have compromised a real system. Canada’s Cyber Centre updated its advisory the same day to say open source reporting indicates exploitation in the wild. SonicWall’s advisory, last updated on 6 October, still says it has no evidence of exploitation, and the flaw is not in CISA’s Known Exploited Vulnerabilities catalogue.

Affected. SMA1000 models 6210, 7210 and 8200v running 12.4.3-03526 or older, or 12.5.0-02952 or older (platform hotfix builds). The attack needs no authentication, only a reachable WorkPlace interface. SSL-VPN on SonicWall firewalls and the SMA 100 series are not affected.

Fix. Upgrade to 12.4.3-03670 or 12.5.0-03082 (platform hotfix) or later, as SonicWall’s advisory lists. SonicWall gives no workaround.

Exposure. http.html:"/__extraweb__" matches the WorkPlace portal in 2,287 results worldwide.

No banner carries an SMA1000 firmware version, so these are exposed portals, not confirmed vulnerable ones. 1,741 of the results answer on port 443 and 576 run at a cloud provider.

CVE-2026-107935 - gvproxy (gvisor-tap-vsock), CVSS 3.1 9.3

What it allows. gvproxy, the network forwarder from the gvisor-tap-vsock package that Podman Desktop bundles, has an unauthenticated /services/forwarder/expose endpoint that does not validate the socket path it is given, so an attacker can delete arbitrary files on the host. Red Hat rates it Important rather than Critical: the attacker must already run code inside the guest VM or a container in it, for example through a malicious image, and can only destroy files owned by the unprivileged user gvproxy runs as, with no code execution on the host by itself. No source reports exploitation, and CISA’s assessment in the NVD record says none.

Affected. gvproxy from gvisor-tap-vsock releases before 0.9.0, which fixed it; no source gives the first affected version. Red Hat lists its Podman Desktop build and OpenShift Dev Spaces as affected, and has podman on RHEL 8, 9 and 10, gvisor-tap-vsock on RHEL 9 and 10, OpenShift Container Platform 4 and several container images under investigation. The endpoint is served on the guest’s virtual network gateway, so only code inside the guest can reach it, not external networks or the host.

Fix. gvisor-tap-vsock 0.9.0 addresses it, per Red Hat. The 0.9.0 release of 8 October stops gvproxy removing files before it listens on a Unix socket, and can optionally require a token on the API it serves to the virtual network. Red Hat lists no fixed package or mitigation yet.

Regional

• CERT.at and Germany’s BSI warned on 9 October of CVE-2026-107406 (CVSS 4.0 9.5), a memory overflow in Citrix NetScaler ADC and NetScaler Gateway that allows remote code execution or denial of service without authentication, though at high attack complexity, on appliances configured as a SAML service provider or identity provider. Appliances already updated for CVE-2026-88771 to CVE-2026-88779 are still affected if they act as a SAML identity provider, and Citrix knew of no attacks when it published. Update to 14.1-73.46, 13.1-64.29, 14.1-73.46 FIPS or 13.1-37.283 (FIPS and NDcPP) or later; Citrix lists no workaround, and an add authentication samlAction or add authentication samlIdPProfile line in the configuration marks an affected setup.
• Austria’s Bundeskriminalamt and central bank started the third #10TageGegenPhishing campaign on 9 October, with about 60 partners spreading its warnings. Austria registered about 7,000 phishing cases and 22 million euros in losses in 2025, and about 5,000 cases and 19 million euros in the first nine months of 2026, including a spring wave of fake ID Austria certificate renewals that cost about 100 victims almost 500,000 euros. Watchlist Internet marked the start with a new toolkit of tips for spotting phishing early, worth passing on to staff.

This digest is created with the help of AI-enabled tools and may contain inaccuracies. If you find one, let me know.