SonicWall has released hotfixes for a maximum-severity vulnerability in its SMA1000 secure remote access appliances, the gateways many governments, managed service providers and enterprises use to let staff reach internal applications from outside. The flaw, CVE-2026-102255, scores a perfect 10.0 on the CVSS scale and can be reached by a remote attacker who has not logged in.
SonicWall disclosed it in advisory SNWLID-2026-0017, published October 5 and updated October 6, alongside three lower-severity bugs. Rewterz summarised the release in a threat advisory of its own.
The appliance can be tricked into making requests for you
CVE-2026-102255 is a server-side request forgery (SSRF), a class of bug where an attacker persuades a server to send requests on their behalf. SonicWall says it sits in the Appliance WorkPlace interface, the portal SMA1000 users log in to, and stems from what the vendor calls an unintended alternate access path. The published CVE description says a remote, unauthenticated attacker could abuse that path to direct the appliance to issue requests for them. SonicWall has not said which internal functions can be reached that way.
The other three issues in the same advisory, in order of severity:
- CVE-2026-102256, remote code execution, CVSS 7.8
- CVE-2026-102257, Zip Slip path traversal, CVSS 7.2
- CVE-2026-102258, stored cross-site scripting, CVSS 5.5
SonicWall gives no further technical detail for those three.
A product line attackers already know well
SonicWall states there is no evidence that any of the four vulnerabilities is being exploited in the wild. The history of this product line is the reason to move quickly anyway. CVE-2026-102255 is the third SMA1000 server-side request forgery to be disclosed this year. The first, CVE-2026-15409, was exploited as a zero-day in July, and the second, CVE-2026-83548, was added to CISA's Known Exploited Vulnerabilities catalog in September, when SonicWall told customers that patching alone would not be enough. Both are in the KEV catalog.
Exposure is not trivial either. According to the Rewterz advisory, Shadowserver tracks more than 400 SMA1000 devices reachable from the internet, though some of those may already be patched.
Upgrade to 12.4.3-03670 or 12.5.0-03082
Affected hardware and virtual models are the SMA 6210, 7210 and 8200v on every hypervisor, running platform-hotfix builds 12.4.3-03526 and older, or 12.5.0-02952 and older. The fixed builds are 12.4.3-03670 and 12.5.0-03082 or later. SonicWall lists no workaround. The SMA100 series and SSL-VPN on SonicWall firewalls are not affected, according to the vendor.
Until the hotfix is in place, restricting internet access to the WorkPlace and management interfaces and watching appliance logs for unusual outbound requests are sensible stopgaps. Teams that cleaned up after July or September should not assume those builds are safe: anything at or below the affected versions above needs this release too.
Three login-free bugs in one product line in a single year is a pattern, and attackers have shown twice already that they are paying attention to it.
This briefing is provided by IntelFusions for informational and defensive purposes only. It is based on sources assessed to be reliable at the time of writing, and analytic judgments carry the confidence levels indicated. Indicators of compromise are defanged; re-arm them only in controlled environments. IntelFusions is not affiliated with the organizations named and makes no warranty as to completeness or accuracy.