SonicWall Patches Maximum Severity Pre-Auth SSRF Flaw inSMA1000 Appliances

SonicWall has fixed four security flaws in its SMA1000 secure remote access appliances, including one
rated 10 out of 10 that lets an attacker who has not logged in make the appliance send requests into
the internal network on their behalf. No attacks have been reported yet, but SMA1000 devices have
been repeatedly targeted this year and no workaround exists. Organisations using SMA1000 should
install SonicWall’s latest platform hotfix now.

1. Vulnerability Details

SonicWall advisory SNWLID-2026-0017, published 6 October 2026, fixes four flaws in SMA1000 models 6210, 7210, and
8200v. The most serious needs no login and is reachable through the Work Place interface; the other three need
administrator access to the appliance. SonicWall lists no workaround.

• CVE-2026-102255 (CVSS 10.0, CWE-918, CWE-441): Pre-authentication SSRF via an unintended alternate access path in the Work Place interface. A remote unauthenticated attacker can make the appliance issue requests on their behalf, reaching internal functionality. Vector CVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:H/A:H.
• CVE-2026-102256 (CVSS 7.8, CWE-78): Post-authentication OS command injection. An attacker authenticated as administrator can, in specific conditions, run arbitrary OS commands, resulting in remote code execution.
• CVE-2026-102257 (CVSS 7.2, CWE-22): Post-authentication Zip Slip in the Appliance Management Console (AMC). A crafted archive writes files outside the intended directory, resulting in remote code execution.
• CVE-2026-102258 (CVSS 5.5, CWE-79): Post-authentication stored cross-site scripting in the AMC. An attacker authenticated as administrator can store JavaScript that runs in the console.

On 6 October 2026, the FBI and USSS issued joint advisory JCSA-20261006-01, describing FortiBleed as ongoing and
noting attackers are still scanning exposed devices. The operation surfaced publicly in June 2026, when SOCRadar
reported 86,644 compromised Fortinet firewalls across 194 countries and CloudSEK analysed an open directory the
attackers accidentally exposed. Fortinet stated on 19 June 2026 that this is not a new Fortinet vulnerability. Attacker IP
addresses were observed between 18 June and 23 July 2026. No threat actor has been named.

2. Affected Products & Fixed Versions

3. Observed Activity

SMA 100 Series appliances and SSL-VPN running on SonicWall firewalls are not affected.

• Exploitation status: SonicWall states there is currently no evidence that any of the four flaws are exploited in the wild. No public proof-of-concept or indicators of compromise have been released.
• Exposure: Shadowserver tracks more than 400 SMA1000 appliances reachable from the internet, though some may already be patched.
• Prior SMA1000 targeting in 2026: Attackers exploited SMA1000 zero-days earlier this year, including CVE-2026 15409 and CVE-2026-15410 in July, which CISA linked to ransomware gangs, and the chained CVE-2026-83548 and CVE-2026-83549 in September.

4. Recommendations

• Find every SMA1000 6210, 7210, and 8200v appliance and check its platform-hotfix version against 12.4.3 03526 and 12.5.0-02952. SMA 100 and firewall SSL-VPN are not affected.
• Install platform-hotfix 12.4.3-03670 or 12.5.0-03082, or later, from mysonicwall.com now. SonicWall lists no workaround, so patching is the only fix.
• Restrict access to the Appliance Management Console (AMC) to trusted management networks, since three of the four flaws need administrator access to the console.
• Review SMA1000 logs for unexpected requests from the appliance to internal hosts, new AMC administrator accounts, and configuration changes made since 6 October 2026.

5. Sources

• https://psirt.global.sonicwall.com/vuln-detail/SNWLID-2026-0017
• https://www.bleepingcomputer.com/news/security/sonicwall-warns-of-max-severity-ssrf-flaw-in-sma1000-gateways
• https://www.truesec.com/hub/blog/critical-sonicwall-sma1000-pre-authentication-ssrf-vulnera
  bility

Enjoyed reading this Threat Intelligence Advisory? Stay updated with our latest exclusive content by following us on Twitter and LinkedIn

No related posts found.